NoamB/sorcery — pull request #437 by vote539 (2013-06-17 11:59:46+00:00)
Title: Fixing potential attack vector and instability in External Submodule -- fixes #407

Formerly, all external ProviderClients saved their access_token in an instance variable. However, there is only one singleton ProviderClient per provider per application, so that access_token was being persisted across requests.

With this commit, ProviderClients no longer save the access token in an instance variable. Instead, they return the access token, and it is saved as an instance variable in the controller, which is not persisted across requests.

This commit also fixes #143 (since the access token is now available as an instance variable to the controller) and #436 (the commit implements the caching mechanism mentioned there).

Care was taken to ensure that the external API is identical. The following changes were made to the internal API:

* `Sorcery::Controller::Submodules::External::Providers::ProviderClient::get_user_hash` now takes one parameter, an access token
* The following methods were added to `Sorcery::Controller::Submodules::External::InstanceMethods`
* `sorcery_get_provider(provider_name)` -- refactoring
* `sorcery_login_url(provider_name)` -- refactoring and caching
* `sorcery_fetch_user_hash(provider_name)` -- refactoring and caching
* `sorcery_fixup_callback_url(provider)` -- refactoring
* The access token object is now available to the controller via `@access_token`, and the user hash object is available to the controller via `@user_hash`.

All eight provider files were updated, as well as `controller/submodules/external.rb`. The changes in `oauth1.rb`, `oauth2.rb`, and `controller.rb` involve only whitespace.