Index: remoting/webapp/third_party_token_fetcher.js |
diff --git a/remoting/webapp/third_party_token_fetcher.js b/remoting/webapp/third_party_token_fetcher.js |
index a16246cd0109067ea9411bdb557c6b3a53fc30e5..ca14489e2ecbc5ebe00a749abad561169fd6e060 100644 |
--- a/remoting/webapp/third_party_token_fetcher.js |
+++ b/remoting/webapp/third_party_token_fetcher.js |
@@ -88,9 +88,9 @@ remoting.ThirdPartyTokenFetcher.prototype.parseRedirectUrl_ = |
function(responseUrl) { |
var token = ''; |
var sharedSecret = ''; |
- if (responseUrl && |
- responseUrl.search(this.redirectUri_ + '#') == 0) { |
- var query = responseUrl.substring(this.redirectUri_.length + 1); |
+ |
+ if (responseUrl && responseUrl.search('#') >= 0) { |
+ var query = responseUrl.substring(responseUrl.search('#') + 1); |
var parts = query.split('&'); |
/** @type {Object.<string>} */ |
var queryArgs = {}; |
@@ -100,8 +100,7 @@ remoting.ThirdPartyTokenFetcher.prototype.parseRedirectUrl_ = |
} |
// Check that 'state' contains the same XSRF token we sent in the request. |
- var xsrfToken = queryArgs['state']; |
- if (xsrfToken == this.xsrfToken_ && |
+ if ('state' in queryArgs && queryArgs['state'] == this.xsrfToken_ && |
'code' in queryArgs && 'access_token' in queryArgs) { |
// Terminology note: |
// In the OAuth code/token exchange semantics, 'code' refers to the value |