From 35a726a961a8298889738d7b5b063a559d689129 Mon Sep 17 00:00:00 2001
From: Hank Grabowski <hankgrabowski@gmail.com>
Date: Mon, 6 Nov 2023 11:25:13 -0500
Subject: [PATCH 1/2] Use strtok to find QP's in Uri for OAuth redirect
 processing

---
 src/Module/OAuth/Token.php | 4 ++--
 src/Security/OAuth.php     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/Module/OAuth/Token.php b/src/Module/OAuth/Token.php
index 7e22a88dab..25c0c69137 100644
--- a/src/Module/OAuth/Token.php
+++ b/src/Module/OAuth/Token.php
@@ -90,10 +90,10 @@ class Token extends BaseApi
 			$me = null;
 		} elseif ($request['grant_type'] == 'authorization_code') {
 			// For security reasons only allow freshly created tokens
-			$uri = new Uri($request['redirect_uri']);
+			$redirect_uri = strtok($request['redirect_uri'],'?');
 			$condition = [
 				"`redirect_uri` LIKE ? AND `id` = ? AND `code` = ? AND `created_at` > ?",
-				'%' . $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath() . '%', $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes')
+				$redirect_uri, $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes')
 			];
 
 			$token = DBA::selectFirst('application-view', ['access_token', 'created_at', 'uid'], $condition);
diff --git a/src/Security/OAuth.php b/src/Security/OAuth.php
index 7655398b35..f6a01a2a87 100644
--- a/src/Security/OAuth.php
+++ b/src/Security/OAuth.php
@@ -131,8 +131,7 @@ class OAuth
 		}
 
 		if (!empty($redirect_uri)) {
-			$uri = new Uri($redirect_uri);
-			$redirect_uri = $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath();
+			$redirect_uri = strtok($redirect_uri, '?');
 			$condition = DBA::mergeConditions($condition, ["`redirect_uri` LIKE ?", '%' . $redirect_uri . '%']);
 		}
 
@@ -143,6 +142,7 @@ class OAuth
 		}
 
 		// The redirect_uri could contain several URI that are separated by spaces.
+		$exploded = explode(' ', $application['redirect_uri']);
 		if (($application['redirect_uri'] != $redirect_uri) && !in_array($redirect_uri, explode(' ', $application['redirect_uri']))) {
 			return [];
 		}

From 4ae78e7ed6e9b4f703831b95fa1ec49a8deaabd7 Mon Sep 17 00:00:00 2001
From: Hank Grabowski <hankgrabowski@gmail.com>
Date: Mon, 6 Nov 2023 13:12:21 -0500
Subject: [PATCH 2/2] Remove extraneous 'exploded' variable that was used
 during debugging

---
 src/Security/OAuth.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/Security/OAuth.php b/src/Security/OAuth.php
index f6a01a2a87..7a0edfef2c 100644
--- a/src/Security/OAuth.php
+++ b/src/Security/OAuth.php
@@ -142,7 +142,6 @@ class OAuth
 		}
 
 		// The redirect_uri could contain several URI that are separated by spaces.
-		$exploded = explode(' ', $application['redirect_uri']);
 		if (($application['redirect_uri'] != $redirect_uri) && !in_array($redirect_uri, explode(' ', $application['redirect_uri']))) {
 			return [];
 		}