@@ -8,13 +8,22 @@

  * Controller of the openshiftConsole

  */

 angular.module('openshiftConsole')

-  .controller('OAuthController', function ($location, $q, RedirectLoginService, DataService, AuthService, Logger) {

+  .controller('OAuthController', function ($scope, $location, $q, RedirectLoginService, DataService, AuthService, Logger) {

     var authLogger = Logger.get("auth");

+    // Initialize to a no-op function.

+    // Needed to let the view confirm a login when the state is unverified. 

+    $scope.completeLogin = function(){};

+    $scope.cancelLogin = function() {

+      $location.replace();

+      $location.url("./");

+    };

+

     RedirectLoginService.finish()

     .then(function(data) {

       var token = data.token;

       var then = data.then;

+      var verified = data.verified;

       var ttl = data.ttl;

       // Try to fetch the user

@@ -25,21 +34,41 @@ angular.module('openshiftConsole')

       .then(function(user) {

         // Set the new user and token in the auth service

         authLogger.log("OAuthController, got user", user);

-        AuthService.setUser(user, token, ttl);

-        // Redirect to original destination (or default to '/')

-        var destination = then || './';

-        if (URI(destination).is('absolute')) {

-          authLogger.log("OAuthController, invalid absolute redirect", destination);

-          destination = './';

+        $scope.completeLogin = function() {

+          // Persist the user

+          AuthService.setUser(user, token, ttl);

+          

+          // Redirect to original destination (or default to './')

+          var destination = then || './';

+          if (URI(destination).is('absolute')) {

+            authLogger.log("OAuthController, invalid absolute redirect", destination);

+            destination = './';

+          }

+          authLogger.log("OAuthController, redirecting", destination);

+          $location.replace();

+          $location.url(destination);

+        };

+        

+        if (verified) {

+          // Automatically complete

+          $scope.completeLogin();

+        } else {

+          // Require the UI to prompt

+          $scope.confirmUser = user;

+          

+          // Additionally, give the UI info about the user being overridden

+          var currentUser = AuthService.UserStore().getUser();

+          if (currentUser && currentUser.metadata.name !== user.metadata.name) {

+            $scope.overriddenUser = currentUser;

+          }

         }

-        authLogger.log("OAuthController, redirecting", destination);

-        $location.url(destination);

       })

       .catch(function(rejection) {

         // Handle an API error response fetching the user

         var redirect = URI('error').query({error: 'user_fetch_failed'}).toString();

         authLogger.error("OAuthController, error fetching user", rejection, "redirecting", redirect);

+        $location.replace();

         $location.url(redirect);

       });

@@ -51,6 +80,7 @@ angular.module('openshiftConsole')

         error_uri: rejection.error_uri || ""

       }).toString();

       authLogger.error("OAuthController, error", rejection, "redirecting", redirect);

+      $location.replace();

       $location.url(redirect);

     });

@@ -29,6 +29,70 @@ angular.module('openshiftConsole')

   this.$get = function($location, $q, Logger) {

     var authLogger = Logger.get("auth");

+    var getRandomInts = function(length) {

+      var randomValues;

+

+      if (window.crypto && window.Uint32Array) {

+        try {

+          var r = new Uint32Array(length);

+          window.crypto.getRandomValues(r);

+          randomValues = [];

+          for (var j=0; j < length; j++) {

+            randomValues.push(r[j]);

+          }

+        } catch(e) {

+          authLogger.debug("RedirectLoginService.getRandomInts: ", e);

+          randomValues = null;

+        }

+      }

+      

+      if (!randomValues) {

+        randomValues = [];

+        for (var i=0; i < length; i++) {

+          randomValues.push(Math.floor(Math.random() * 4294967296));

+        }

+      }

+      

+      return randomValues;

+    };

+    

+    var nonceKey = "RedirectLoginService.nonce";

+    var makeState = function(then) {

+      var nonce = String(new Date().getTime()) + "-" + getRandomInts(8).join("");

+      try {

+        window.localStorage[nonceKey] = nonce;

+      } catch(e) {

+        authLogger.log("RedirectLoginService.makeState, localStorage error: ", e);

+      }

+      return JSON.stringify({then: then, nonce:nonce});

+    };

+    var parseState = function(state) {

+      var retval = {

+        then: null,

+        verified: false

+      };

+

+      var nonce = "";

+      try {

+        nonce = window.localStorage[nonceKey];

+        window.localStorage.removeItem(nonceKey);

+      } catch(e) {

+        authLogger.log("RedirectLoginService.parseState, localStorage error: ", e);

+      }

+      

+      try {

+        var data = state ? JSON.parse(state) : {};

+        if (data && data.nonce && nonce && data.nonce === nonce) {

+          retval.verified = true;

+          retval.then = data.then;

+        }

+      } catch(e) {

+        authLogger.error("RedirectLoginService.parseState, state error: ", e);

+      }

+      authLogger.error("RedirectLoginService.parseState", retval);

+      return retval;

+    };

+

     return {

       // Returns a promise that resolves with {user:{...}, token:'...', ttl:X}, or rejects with {error:'...'[,error_description:'...',error_uri:'...']}

       login: function() {

@@ -49,7 +113,7 @@ angular.module('openshiftConsole')

         uri.query({

           client_id: _oauth_client_id,

           response_type: 'token',

-          state: returnUri.toString(),

+          state: makeState(returnUri.toString()),

           redirect_uri: _oauth_redirect_uri

         });

         authLogger.log("RedirectLoginService.login(), redirecting", uri.toString());

@@ -59,7 +123,7 @@ angular.module('openshiftConsole')

       },

       // Parses oauth callback parameters from window.location

-      // Returns a promise that resolves with {token:'...',then:'...'}, or rejects with {error:'...'[,error_description:'...',error_uri:'...']}

+      // Returns a promise that resolves with {token:'...',then:'...',verified:true|false}, or rejects with {error:'...'[,error_description:'...',error_uri:'...']}

       // If no token and no error is present, resolves with {}

       // Example error codes: https://tools.ietf.org/html/rfc6749#section-5.2

       finish: function() {

@@ -71,12 +135,12 @@ angular.module('openshiftConsole')

         var fragmentParams = new URI("?" + u.fragment()).query(true);

         authLogger.log("RedirectLoginService.finish()", queryParams, fragmentParams);

-       // Error codes can come in query params or fragment params

-       // Handle an error response from the OAuth server

+        // Error codes can come in query params or fragment params

+        // Handle an error response from the OAuth server

         var error = queryParams.error || fragmentParams.error;

-       if (error) {

-         var error_description = queryParams.error_description || fragmentParams.error_description;

-         var error_uri = queryParams.error_uri || fragmentParams.error_uri;

+        if (error) {

+          var error_description = queryParams.error_description || fragmentParams.error_description;

+          var error_uri = queryParams.error_uri || fragmentParams.error_uri;

           authLogger.log("RedirectLoginService.finish(), error", error, error_description, error_uri);

           return $q.reject({

             error: error,

@@ -85,13 +149,16 @@ angular.module('openshiftConsole')

           });

         }

+        var stateData = parseState(fragmentParams.state);

+        

         // Handle an access_token response

         if (fragmentParams.access_token && (fragmentParams.token_type || "").toLowerCase() === "bearer") {

           var deferred = $q.defer();

           deferred.resolve({

             token: fragmentParams.access_token,

             ttl: fragmentParams.expires_in,

-            then: fragmentParams.state

+            then: stateData.state,

+            verified: stateData.verified

           });

           return deferred.promise;

         }

@@ -2,12 +2,26 @@

 <div class="wrap no-sidebar">

   <div class="middle surface-shaded">

     <div class="container surface-shaded">

-      <div>

+      <div ng-if="!confirmUser">

         <h1 style="margin-top: 10px;">Logging in&hellip;</h1>

-        <div>

-          Please wait while you are logged in...

-        </div>

+        <p>Please wait while you are logged in&hellip;</p>

       </div>

+      

+      <div ng-if="confirmUser && !overriddenUser">

+        <h1 style="margin-top: 10px;">Confirm Login</h1>

+        <p>You are being logged in as <code>{{confirmUser.metadata.name}}</code>.</p>

+        <button class="btn btn-lg btn-primary" type="button" ng-click="completeLogin();">Continue</button>

+        <button class="btn btn-lg btn-default" type="button" ng-click="cancelLogin();">Cancel</button>

+      </div>

+      

+      <div ng-if="confirmUser && overriddenUser">

+        <h1 style="margin-top: 10px;">Confirm User Change</h1>

+        <p>You are about to change users from <code>{{overriddenUser.metadata.name}}</code> to <code>{{confirmUser.metadata.name}}</code>.</p>

+        <p>If this is unexpected, click Cancel. This could be an attempt to trick you into acting as another user.</p>

+        <button class="btn btn-lg btn-danger" type="button" ng-click="completeLogin();">Switch Users</button>

+        <button class="btn btn-lg btn-primary" type="button" ng-click="cancelLogin();">Cancel</button>

+      </div>

+      

     </div>

   </div>

 </div>

@@ -2582,7 +2582,49 @@ return a && (b = a), b;

 }, this.OAuthRedirectURI = function(a) {

 return a && (c = a), c;

 }, this.$get = [ "$location", "$q", "Logger", function(d, e, f) {

-var g = f.get("auth");

+var g = f.get("auth"), h = function(a) {

+var b;

+if (window.crypto && window.Uint32Array) try {

+var c = new Uint32Array(a);

+window.crypto.getRandomValues(c), b = [];

+for (var d = 0; a > d; d++) b.push(c[d]);

+} catch (e) {

+g.debug("RedirectLoginService.getRandomInts: ", e), b = null;

+}

+if (!b) {

+b = [];

+for (var f = 0; a > f; f++) b.push(Math.floor(4294967296 * Math.random()));

+}

+return b;

+}, i = "RedirectLoginService.nonce", j = function(a) {

+var b = String(new Date().getTime()) + "-" + h(8).join("");

+try {

+window.localStorage[i] = b;

+} catch (c) {

+g.log("RedirectLoginService.makeState, localStorage error: ", c);

+}

+return JSON.stringify({

+then:a,

+nonce:b

+});

+}, k = function(a) {

+var b = {

+then:null,

+verified:!1

+}, c = "";

+try {

+c = window.localStorage[i], window.localStorage.removeItem(i);

+} catch (d) {

+g.log("RedirectLoginService.parseState, localStorage error: ", d);

+}

+try {

+var e = a ? JSON.parse(a) :{};

+e && e.nonce && c && e.nonce === c && (b.verified = !0, b.then = e.then);

+} catch (d) {

+g.error("RedirectLoginService.parseState, state error: ", d);

+}

+return g.error("RedirectLoginService.parseState", b), b;

+};

 return {

 login:function() {

 if ("" === a) return e.reject({

@@ -2601,7 +2643,7 @@ var f = e.defer(), h = new URI(b), i = new URI(d.url()).fragment("");

 return h.query({

 client_id:a,

 response_type:"token",

-state:i.toString(),

+state:j(i.toString()),

 redirect_uri:c

 }), g.log("RedirectLoginService.login(), redirecting", h.toString()), window.location.href = h.toString(), f.promise;

 },

@@ -2617,13 +2659,15 @@ error_description:h,

 error_uri:i

 });

 }

+var j = k(c.state);

 if (c.access_token && "bearer" === (c.token_type || "").toLowerCase()) {

-var j = e.defer();

-return j.resolve({

+var l = e.defer();

+return l.resolve({

 token:c.access_token,

 ttl:c.expires_in,

-then:c.state

-}), j.promise;

+then:j.state,

+verified:j.verified

+}), l.promise;

 }

 return e.reject({

 error:"invalid_request",

@@ -4924,35 +4968,43 @@ hideFilterWidget:!0

 }, c.get(a.project).then(_.spread(function(a, c) {

 b.project = a, b.projectContext = c;

 }));

-} ]), angular.module("openshiftConsole").controller("OAuthController", [ "$location", "$q", "RedirectLoginService", "DataService", "AuthService", "Logger", function(a, b, c, d, e, f) {

-var g = f.get("auth");

-c.finish().then(function(b) {

-var c = b.token, f = b.then, h = b.ttl, i = {

+} ]), angular.module("openshiftConsole").controller("OAuthController", [ "$scope", "$location", "$q", "RedirectLoginService", "DataService", "AuthService", "Logger", function(a, b, c, d, e, f, g) {

+var h = g.get("auth");

+a.completeLogin = function() {}, a.cancelLogin = function() {

+b.replace(), b.url("./");

+}, d.finish().then(function(c) {

+var d = c.token, g = c.then, i = c.verified, j = c.ttl, k = {

 errorNotification:!1,

 http:{

 auth:{

-token:c,

+token:d,

 triggerLogin:!1

 }

 }

 };

-g.log("OAuthController, got token, fetching user", i), d.get("users", "~", {}, i).then(function(b) {

-g.log("OAuthController, got user", b), e.setUser(b, c, h);

-var d = f || "./";

-URI(d).is("absolute") && (g.log("OAuthController, invalid absolute redirect", d), d = "./"), g.log("OAuthController, redirecting", d), a.url(d);

-})["catch"](function(b) {

+h.log("OAuthController, got token, fetching user", k), e.get("users", "~", {}, k).then(function(c) {

+if (h.log("OAuthController, got user", c), a.completeLogin = function() {

+f.setUser(c, d, j);

+var a = g || "./";

+URI(a).is("absolute") && (h.log("OAuthController, invalid absolute redirect", a), a = "./"), h.log("OAuthController, redirecting", a), b.replace(), b.url(a);

+}, i) a.completeLogin(); else {

+a.confirmUser = c;

+var e = f.UserStore().getUser();

+e && e.metadata.name !== c.metadata.name && (a.overriddenUser = e);

+}

+})["catch"](function(a) {

 var c = URI("error").query({

 error:"user_fetch_failed"

 }).toString();

-g.error("OAuthController, error fetching user", b, "redirecting", c), a.url(c);

+h.error("OAuthController, error fetching user", a, "redirecting", c), b.replace(), b.url(c);

 });

-})["catch"](function(b) {

+})["catch"](function(a) {

 var c = URI("error").query({

-error:b.error || "",

-error_description:b.error_description || "",

-error_uri:b.error_uri || ""

+error:a.error || "",

+error_description:a.error_description || "",

+error_uri:a.error_uri || ""

 }).toString();

-g.error("OAuthController, error", b, "redirecting", c), a.url(c);

+h.error("OAuthController, error", a, "redirecting", c), b.replace(), b.url(c);

 });

 } ]), angular.module("openshiftConsole").controller("ErrorController", [ "$scope", function(a) {

 var b = URI(window.location.href).query(!0), c = b.error;

@@ -14184,11 +14236,22 @@ var _scriptsTemplatesJs = []byte(`angular.module('openshiftConsoleTemplates', []

     "<div class=\"wrap no-sidebar\">\n" +

     "<div class=\"middle surface-shaded\">\n" +

     "<div class=\"container surface-shaded\">\n" +

-    "<div>\n" +

+    "<div ng-if=\"!confirmUser\">\n" +

     "<h1 style=\"margin-top: 10px\">Logging in&hellip;</h1>\n" +

-    "<div>\n" +

-    "Please wait while you are logged in...\n" +

-    "</div>\n" +

+    "<p>Please wait while you are logged in&hellip;</p>\n" +

+    "</div>\n" +

+    "<div ng-if=\"confirmUser && !overriddenUser\">\n" +

+    "<h1 style=\"margin-top: 10px\">Confirm Login</h1>\n" +

+    "<p>You are being logged in as <code>{{confirmUser.metadata.name}}</code>.</p>\n" +

+    "<button class=\"btn btn-lg btn-primary\" type=\"button\" ng-click=\"completeLogin();\">Continue</button>\n" +

+    "<button class=\"btn btn-lg btn-default\" type=\"button\" ng-click=\"cancelLogin();\">Cancel</button>\n" +

+    "</div>\n" +

+    "<div ng-if=\"confirmUser && overriddenUser\">\n" +

+    "<h1 style=\"margin-top: 10px\">Confirm User Change</h1>\n" +

+    "<p>You are about to change users from <code>{{overriddenUser.metadata.name}}</code> to <code>{{confirmUser.metadata.name}}</code>.</p>\n" +

+    "<p>If this is unexpected, click Cancel. This could be an attempt to trick you into acting as another user.</p>\n" +

+    "<button class=\"btn btn-lg btn-danger\" type=\"button\" ng-click=\"completeLogin();\">Switch Users</button>\n" +

+    "<button class=\"btn btn-lg btn-primary\" type=\"button\" ng-click=\"cancelLogin();\">Cancel</button>\n" +

     "</div>\n" +

     "</div>\n" +

     "</div>\n" +