FIX: Return a 404 if the auth session is not present

2025-02-25 18:55:32 -06:00 · 2017-05-04 15:35:03 -04:00
parent c182dcc64c
commit 777f1f0f47
2 changed files with 9 additions and 0 deletions
--- a/app/controllers/users/omniauth_callbacks_controller.rb
+++ b/app/controllers/users/omniauth_callbacks_controller.rb
@@ -31,6 +31,8 @@ class Users::OmniauthCallbacksController < ApplicationController

  def complete
    auth = request.env["omniauth.auth"]
+    raise Discourse::NotFound unless request.env["omniauth.auth"]
+
    auth[:session] = session

    authenticator = self.class.find_authenticator(params[:provider])