auth: oauth2 - Set username after parsing

Otherwise we might mistakenly set username despite the
token being malformed.

diff --git a/src/auth/mech-oauth2.c b/src/auth/mech-oauth2.c
index 52eb1007ed915ebb133c38629b11f5bc9448954b..3e652ecbd12c2888e962a48dd49ce8a6eef31689 100644 (file)
--- a/src/auth/mech-oauth2.c
+++ b/src/auth/mech-oauth2.c
@@ -101,19 +101,14 @@ mech_xoauth2_auth_continue(struct auth_request *request,
        const char *error;
        const char *token = NULL;
        const char *const *ptr;
+       const char *username;
        const char *const *fields =
                t_strsplit(t_strndup(data, data_size), "\x01");
        for(ptr = fields; *ptr != NULL; ptr++) {
                if (str_begins(*ptr, "user=")) {
                        /* xoauth2 does not require unescaping because the data
                           format does not contain anything to escape */
-                       const char *username = (*ptr)+5;
-                       if (!auth_request_set_username(request, username, &error)) {
-                               e_info(request->mech_event,
-                                      "%s", error);
-                               auth_request_fail(request);
-                               return;
-                       }
+                       username = (*ptr)+5;
                        user_given = TRUE;
                } else if (str_begins(*ptr, "auth=")) {
                        const char *value = (*ptr)+5;
@@ -130,6 +125,13 @@ mech_xoauth2_auth_continue(struct auth_request *request,
                /* do not fail on unexpected fields */
        }
 
+       if (user_given && !auth_request_set_username(request, username, &error)) {
+               e_info(request->mech_event,
+                      "%s", error);
+               auth_request_fail(request);
+               return;
+       }
+
        if (user_given && token != NULL)
                auth_request_verify_plain(request, token,
                                          xoauth2_verify_callback);
@@ -196,9 +198,6 @@ mech_oauthbearer_auth_continue(struct auth_request *request,
                                        "Invalid username escaping");
                                 auth_request_fail(request);
                                 return;
-                       } else if (!auth_request_set_username(request, username, &error)) {
-                               e_info(request->mech_event,
-                                      "%s", error);
                        } else {
                                user_given = TRUE;
                        }
@@ -226,6 +225,12 @@ mech_oauthbearer_auth_continue(struct auth_request *request,
                }
                /* do not fail on unexpected fields */
        }
+       if (user_given && !auth_request_set_username(request, username, &error)) {
+               e_info(request->mech_event,
+                      "%s", error);
+               auth_request_fail(request);
+               return;
+       }
        if (user_given && token != NULL)
                auth_request_verify_plain(request, token,
                                          oauthbearer_verify_callback);