Merge pull request #913 from martinstuecklschwaiger/5.x

Strip 'code' param

Author: yguedidi

src/Facebook/Helpers/FacebookRedirectLoginHelper.php

@@ -222,8 +222,8 @@ public function getAccessToken($redirectUrl = null)
         $this->resetCsrf();
 
         $redirectUrl = $redirectUrl ?: $this->urlDetectionHandler->getCurrentUrl();
-        // At minimum we need to remove the state param
-        $redirectUrl = FacebookUrlManipulator::removeParamsFromUrl($redirectUrl, ['state']);
+        // At minimum we need to remove the 'state' and 'code' params
+        $redirectUrl = FacebookUrlManipulator::removeParamsFromUrl($redirectUrl, ['code', 'state']);
 
         return $this->oAuth2Client->getAccessTokenFromCode($code, $redirectUrl);
     }

tests/Fixtures/FooRedirectLoginOAuth2Client.php

@@ -23,12 +23,13 @@
  */
 namespace Facebook\Tests\Fixtures;
 
+use Facebook\Authentication\AccessToken;
 use Facebook\Authentication\OAuth2Client;
 
 class FooRedirectLoginOAuth2Client extends OAuth2Client
 {
     public function getAccessTokenFromCode($code, $redirectUri = '', $machineId = null)
     {
-        return 'foo_token_from_code|' . $code . '|' . $redirectUri;
+        return new AccessToken('foo_token_from_code|' . $code . '|' . $redirectUri);
     }
 }

tests/Helpers/FacebookRedirectLoginHelperTest.php

@@ -44,6 +44,9 @@ class FacebookRedirectLoginHelperTest extends \PHPUnit_Framework_TestCase
     protected $redirectLoginHelper;
 
     const REDIRECT_URL = 'http://invalid.zzz';
+    const FOO_CODE = "foo_code";
+    const FOO_STATE = "foo_state";
+    const FOO_PARAM = "some_param=blah";
 
     protected function setUp()
     {
@@ -94,12 +97,18 @@ public function testLogoutURL()
     public function testAnAccessTokenCanBeObtainedFromRedirect()
     {
         $this->persistentDataHandler->set('state', 'foo_state');
-        $_GET['state'] = 'foo_state';
-        $_GET['code'] = 'foo_code';
+        $_GET['state'] = static::FOO_STATE;
+        $_GET['code'] = static::FOO_CODE;
 
-        $accessToken = $this->redirectLoginHelper->getAccessToken(self::REDIRECT_URL);
+        $fullUrl = self::REDIRECT_URL . '?state=' . static::FOO_STATE . '&code=' . static::FOO_CODE . '&' . static::FOO_PARAM;
 
-        $this->assertEquals('foo_token_from_code|foo_code|' . self::REDIRECT_URL, (string)$accessToken);
+        $accessToken = $this->redirectLoginHelper->getAccessToken($fullUrl);
+
+        // code and state should be stripped from the URL
+        $expectedUrl = self::REDIRECT_URL . '?' . static::FOO_PARAM;
+        $expectedString = 'foo_token_from_code|' . static::FOO_CODE . '|' . $expectedUrl;
+
+        $this->assertEquals($expectedString, $accessToken->getValue());
     }
 
     public function testACustomCsprsgCanBeInjected()