mariusz.pacek/keycloak
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #3433 from stianst/KEYCLOAK-3641

Browse Source 
KEYCLOAK-3641 Clicking an invalid verification link due to re-send re…
This commit is contained in:
Stian Thorgersen authored and GitHub committed 2016-10-28 06:40:27 +02:00
2 parents f13d759a61 c6ac3266f0
commit 0c6b47b9f2
2 files changed
+53 -17
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
+16 -9
View File
@@ -693,6 +693,20 @@ public class LoginActionsService {
public Response emailVerification(@QueryParam("code") String code, @QueryParam("key") String key) {
event.event(EventType.VERIFY_EMAIL);
if (key != null) {
ClientSessionModel clientSession = null;
String keyFromSession = null;
if (code != null) {
clientSession = ClientSessionCode.getClientSession(code, session, realm);
keyFromSession = clientSession.getNote(Constants.VERIFY_EMAIL_KEY);
}
if (clientSession == null || !key.equals(keyFromSession)) {
ServicesLogger.LOGGER.invalidKeyForEmailVerification();
event.error(Errors.INVALID_CODE);
throw new WebApplicationException(ErrorPage.error(session, Messages.STALE_VERIFY_EMAIL_LINK));
}
clientSession.removeNote(Constants.VERIFY_EMAIL_KEY);
Checks checks = new Checks();
if (!checks.verifyCode(code, ClientSessionModel.Action.REQUIRED_ACTIONS.name(), ClientSessionCode.ActionType.USER)) {
if (checks.clientCode == null && checks.result.isClientSessionNotFound() || checks.result.isIllegalHash()) {
@@ -700,8 +714,9 @@ public class LoginActionsService {
}
return checks.response;
}
ClientSessionCode accessCode = checks.clientCode;
ClientSessionModel clientSession = accessCode.getClientSession();
clientSession = accessCode.getClientSession();
if (!ClientSessionModel.Action.VERIFY_EMAIL.name().equals(clientSession.getNote(AuthenticationManager.CURRENT_REQUIRED_ACTION))) {
ServicesLogger.LOGGER.reqdActionDoesNotMatch();
event.error(Errors.INVALID_CODE);
@@ -713,14 +728,6 @@ public class LoginActionsService {
initEvent(clientSession);
event.event(EventType.VERIFY_EMAIL).detail(Details.EMAIL, user.getEmail());
String keyFromSession = clientSession.getNote(Constants.VERIFY_EMAIL_KEY);
clientSession.removeNote(Constants.VERIFY_EMAIL_KEY);
if (!key.equals(keyFromSession)) {
ServicesLogger.LOGGER.invalidKeyForEmailVerification();
event.error(Errors.INVALID_USER_CREDENTIALS);
throw new WebApplicationException(ErrorPage.error(session, Messages.INVALID_CODE));
}
user.setEmailVerified(true);
user.removeRequiredAction(RequiredAction.VERIFY_EMAIL);