Added check so that unauthorized request tokens cannot be exchanged for access tokens.

1 files changed, 9 insertions, 0 deletions

diff --git a/src/DotNetOAuth/ServiceProvider.cs b/src/DotNetOAuth/ServiceProvider.cs
index 6b87079..a6ed9e0 100644
--- a/src/DotNetOAuth/ServiceProvider.cs
+++ b/src/DotNetOAuth/ServiceProvider.cs
@@ -6,6 +6,7 @@
 

 namespace DotNetOAuth {

 	using System;

+	using System.Globalization;

 	using System.Web;

 	using DotNetOAuth.ChannelElements;

 	using DotNetOAuth.Messages;

@@ -127,6 +128,14 @@ namespace DotNetOAuth {
 		}

 

 		internal void SendAccessToken(RequestAccessTokenMessage request) {

+			if (!this.TokenManager.IsRequestTokenAuthorized(request.RequestToken)) {

+				throw new ProtocolException(

+					string.Format(

+						CultureInfo.CurrentCulture,

+						Strings.AccessTokenNotAuthorized,

+						request.RequestToken));

+			}

+

 			string accessToken = this.TokenGenerator.GenerateAccessToken(request.ConsumerKey);

 			string tokenSecret = this.TokenGenerator.GenerateSecret();

 			this.TokenManager.ExpireRequestTokenAndStoreNewAccessToken(request.ConsumerKey, request.RequestToken, accessToken, tokenSecret);