Look for code in _GET or _POST explicitly.

This change is for those using frameworks or PHP configurations that strip out _REQUEST params.
auth0 · Dec 28, 2016 · dfd7e0a · dfd7e0a
1 parent 561db79
commit dfd7e0a
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/API/Oauth2Client.php b/src/API/Oauth2Client.php
@@ -237,10 +237,11 @@ private function dontPersist($name) {
      * @return Boolean Whether it exchanged the code or not correctly
      */
     public function exchangeCode() {
-        if (!isset($_REQUEST['code'])) {
+        $code = $_GET['code'] ?: $_POST['code'];
+        if (!isset($code)) {
+            $this->debugInfo("No code found in _GET or _POST params.");
             return false;
         }
-        $code = $_REQUEST['code'];
 
         $this->debugInfo("Code: ".$code);