facebook/facebook-php-sdk-v4 — pull request #276 by SammyK (2014-11-20 19:42:46+00:00)
Title: [4.1] Fixed bug with not filtering state from callback URL

So after trying to do some real-world tests with the new URL detection stuff, it looks like Facebook will return the following error if the `state` param is not filtered from the `redirect_uri` in the callback:

> Error validating verification code. Please make sure your redirect_uri is identical to the one you used in the OAuth dialog request

So this PR fixes this by removing just the `state` param and nothing else.

It also includes more explicit CSRF checks and throws an `FacebookSDKException` when CSRF validation fails.

It also includes getters for the error responses. So now handling failed logins can be more explicit.

```php
$helper = $fb->getRedirectLoginHelper();
$facebookClient = $fb->getClient();

try {
$accessToken = $helper->getAccessToken($facebookClient);
} catch(FacebookResponseException $e) {
// When Graph returns an error
echo 'Graph returned an error: ' . $e->getMessage();
exit;
} catch(FacebookSDKException $e) {
// When validation fails or other local issues
echo 'Facebook SDK returned an error: ' . $e->getMessage();
exit;
}

// Not logged in - user rejected or some other reason
if ( ! isset($accessToken)) {
echo "

Error: " . $helper->getError() . "

\n\n";
echo "

Error Code: " . $helper->getErrorCode() . "

\n\n";
echo "

Error Reason: " . $helper->getErrorReason() . "

\n\n";
echo "

Error Description: " . $helper->getErrorDescription() . "

\n\n";
exit;
}

// Logged in
var_dump($accessToken);
```

Oh yeah, I also removed `loadState()` and `storeState()` since the new way to overwrite those is with the `PersistentDataInterface`. Forgot to kill those in that PR. :)