romfast/romfast-website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

oauth2: fix buton Actualizare - refresh_token acceptat si prin POST body

Browse Source 
ROACONT refreshToken trimite refresh_token prin POST (anaf_efactura.prg:719),
iar originalul citea parametrii cu $_REQUEST (GET+POST). Citirea doar din
$_GET rupea butonul: cererea cadea pe redirectul authorize, logincert.anaf.ro
cerea certificat client si msxml6 dadea "Access is denied" (1429 nehandled).
Deploy-uit si verificat pe productie (POST si GET -> passthrough JSON ANAF).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Marius Mutu
2026-07-07 21:53:36 +03:00
parent 1c80ab98fc
commit becbbe2be4
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
oauth2/index.php
View File

@@ -60,7 +60,10 @@ function showPage($page_title, $h1_text, $h1_color, $body_text) {
// ===================================================================
// Citire explicita parametri GET (FR-10: elimina parse_str care injecta variabile)
// ===================================================================
$refresh_token = isset($_GET['refresh_token']) ? (string)$_GET['refresh_token'] : '';
// refresh_token vine din ROA prin POST body (refreshToken - anaf_efactura.prg) sau GET;
// originalul folosea $_REQUEST, deci accepta ambele - citirea doar din $_GET rupe butonul Actualizare
$refresh_token = isset($_POST['refresh_token']) ? (string)$_POST['refresh_token']
: (isset($_GET['refresh_token']) ? (string)$_GET['refresh_token'] : '');
$code = isset($_GET['code']) ? (string)$_GET['code'] : '';
$state_param = isset($_GET['state']) ? (string)$_GET['state'] : '';
$error_param = isset($_GET['error']) ? (string)$_GET['error'] : '';