Security: OauthController::authorize() missing CSRF check #108

New Issue

2026-06-06T11:50:06Z

jmiller commented

2026-06-06 11:50:06 +00:00

Audit Finding

Severity: High

Issue:
OauthController::authorize() does not call $this->checkToken(). An attacker could trick an admin into clicking a crafted link to initiate an OAuth flow. While the callback has nonce protection, the initiation should be CSRF-protected.

Fix: Add $this->checkToken() at start of authorize(). Update service edit template to include CSRF token.

Files: OauthController.php

## Audit Finding **Severity:** High **Issue:** `OauthController::authorize()` does not call `$this->checkToken()`. An attacker could trick an admin into clicking a crafted link to initiate an OAuth flow. While the callback has nonce protection, the initiation should be CSRF-protected. **Fix:** Add `$this->checkToken()` at start of `authorize()`. Update service edit template to include CSRF token. **Files:** `OauthController.php`

jmiller commented

2026-06-06 11:50:10 +00:00

Branch created: feature/108-security-oauthcontroller-authorize-missi

git fetch origin
git checkout feature/108-security-oauthcontroller-authorize-missi

Branch created: [`feature/108-security-oauthcontroller-authorize-missi`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomCross/src/branch/feature/108-security-oauthcontroller-authorize-missi) ```bash git fetch origin git checkout feature/108-security-oauthcontroller-authorize-missi ```

jmiller referenced this issue from a commit

2026-06-06 14:33:22 +00:00

security: fix 9 security and critical bugs (#107-#115, #120)

jmiller closed this issue

2026-06-06 14:35:08 +00:00

Sign in to join this conversation.

Priority -

Type —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCross#108