ABC-153: don't use http redirects with 4xx/5xx status codes (#8178)

* don't use http redirects with 4xx/5xx status codes * minor html syntax fix
2018-02-02 07:29:11 -06:00
--- a/app/oauth.go
+++ b/app/oauth.go
@@ -564,7 +564,7 @@ func generateOAuthStateTokenExtra(email, action, cookie string) string {

 func (a *App) GetAuthorizationCode(w http.ResponseWriter, r *http.Request, service string, props map[string]string, loginHint string) (string, *model.AppError) {
 	sso := a.Config().GetSSOService(service)
-	if sso != nil && !sso.Enable {
+	if sso == nil || !sso.Enable {
 		return "", model.NewAppError("GetAuthorizationCode", "api.user.get_authorization_code.unsupported.app_error", nil, "service="+service, http.StatusNotImplemented)
 	}

--- a/utils/api.go
+++ b/utils/api.go
@@ -4,6 +4,8 @@
 package utils

 import (
+	"fmt"
+	"html/template"
 	"net/http"
 	"net/url"
 	"strings"
@@ -31,18 +33,21 @@ func OriginChecker(allowedOrigins string) func(*http.Request) bool {
 }

 func RenderWebError(err *model.AppError, w http.ResponseWriter, r *http.Request) {
-	message := err.Message
-	details := err.DetailedError
-
 	status := http.StatusTemporaryRedirect
 	if err.StatusCode != http.StatusInternalServerError {
 		status = err.StatusCode
 	}

-	http.Redirect(
-		w,
-		r,
-		"/error?message="+url.QueryEscape(message)+
-			"&details="+url.QueryEscape(details),
-		status)
+	destination := strings.TrimRight(GetSiteURL(), "/") + "/error?message=" + url.QueryEscape(err.Message)
+	if status >= 300 && status < 400 {
+		http.Redirect(w, r, destination, status)
+		return
+	}
+
+	w.WriteHeader(status)
+	fmt.Fprintln(w, `<!DOCTYPE html><html><head></head>`)
+	fmt.Fprintln(w, `<body onload="window.location = '`+template.HTMLEscapeString(template.JSEscapeString(destination))+`'">`)
+	fmt.Fprintln(w, `<noscript><meta http-equiv="refresh" content="0; url=`+template.HTMLEscapeString(destination)+`"></noscript>`)
+	fmt.Fprintln(w, `<a href="`+template.HTMLEscapeString(destination)+`" style="color: #c0c0c0;">...</a>`)
+	fmt.Fprintln(w, `</body></html>`)
 }