From 7a628409db3b67431cfecc69b8031ffa4abddd48 Mon Sep 17 00:00:00 2001
From: Alex Bilbie <alexbilbie@Alexs-Home-iMac.local>
Date: Fri, 12 Feb 2016 09:03:35 +0000
Subject: [PATCH] Validate client can now optionally validate secret +
 redirectUri, and actually validate the redirectUri

---
 src/Grant/AbstractGrant.php | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/src/Grant/AbstractGrant.php b/src/Grant/AbstractGrant.php
index 208e5fbc..4b589f4e 100644
--- a/src/Grant/AbstractGrant.php
+++ b/src/Grant/AbstractGrant.php
@@ -143,14 +143,20 @@ abstract class AbstractGrant implements GrantTypeInterface
     }
 
     /**
+     * Validate the client
+     *
      * @param \Psr\Http\Message\ServerRequestInterface $request
+     * @param bool                                     $validateSecret
+     * @param bool                                     $validateRedirectUri
      *
      * @return \League\OAuth2\Server\Entities\Interfaces\ClientEntityInterface
-     *
      * @throws \League\OAuth2\Server\Exception\OAuthServerException
      */
-    protected function validateClient(ServerRequestInterface $request)
-    {
+    protected function validateClient(
+        ServerRequestInterface $request,
+        $validateSecret = true,
+        $validateRedirectUri = false
+    ) {
         $clientId = $this->getRequestParameter(
             'client_id',
             $request,
@@ -165,14 +171,19 @@ abstract class AbstractGrant implements GrantTypeInterface
             $request,
             $this->getServerParameter('PHP_AUTH_PW', $request)
         );
-        if (is_null($clientSecret)) {
+        if (is_null($clientSecret) && $validateSecret === true) {
             throw OAuthServerException::invalidRequest('client_secret', null, '`%s` parameter is missing');
         }
 
+        $redirectUri = $this->getRequestParameter('redirect_uri', $request, null);
+        if (is_null($redirectUri) && $validateRedirectUri === true) {
+            throw OAuthServerException::invalidRequest('redirect_uri', null, '`%s` parameter is missing');
+        }
+
         $client = $this->clientRepository->getClientEntity(
             $clientId,
             $clientSecret,
-            null,
+            $redirectUri,
             $this->getIdentifier()
         );