facebook/facebook-php-sdk — pull request #57 by kilotaras (2013-01-14 23:40:41+00:00)
Title: Fixed a vulnerability with signed requests

See the next scenario.

1) Alice is logged into Facebook
2) Alice visits example.com/with_js_sdk.php (our PHP SDK example endpoint). The SDK will write her signed_request, user_id, and access_token to a session cookie.
3) Alice is then tricked into visiting example.com/with_js_sdk.php?signed_request={Bob's signed request}. The SDK will then set the user_id to Bob, while keeping Alice's access_token in persistent storage
4) If example.com has another endpoint that authenticates based on getUser(), Bob now has access to data returned by Alice's access_token.

This fixes it.