Merge pull request #503 from XeroAPI/csrf

refactors use of params and check for csrf
XeroAPI · Mar 15, 2021 · 8de095c · 8de095c
2 parents a1b4008 + 7041360
commit 8de095c
Show file tree

Hide file tree

Showing 18 changed files with 18,887 additions and 14,048 deletions.
diff --git a/docs/v4/accounting/index.html b/docs/v4/accounting/index.html
diff --git a/docs/v4/assets/index.html b/docs/v4/assets/index.html
@@ -1314,7 +1314,7 @@ <h1>Xero Assets API</h1>
             <h2 id="welcome-to-apidoc">API and SDK Documentation</h2>
               <div class="app-desc">Version: 1.0.0</div>
             <!--
-              <div class="app-desc">Version: 2.9.4</div>
+              <div class="app-desc">Version: 2.10.0</div>
             <hr>
             <div id="app-description" class="app-desc">
                 The Assets API exposes fixed asset related functions of the Xero Accounting application and can be used for a variety of purposes such as creating assets, retrieving asset valuations etc.

diff --git a/docs/v4/bankfeeds/index.html b/docs/v4/bankfeeds/index.html
@@ -1188,7 +1188,7 @@ <h1>Xero Bank Feeds API</h1>
             <h2 id="welcome-to-apidoc">API and SDK Documentation</h2>
               <div class="app-desc">Version: 1.0.0</div>
             <!--
-              <div class="app-desc">Version: 2.9.4</div>
+              <div class="app-desc">Version: 2.10.0</div>
             <hr>
             <div id="app-description" class="app-desc">
                 The Bank Feeds API is a closed API that is only available to financial institutions that have an established financial services partnership with Xero. If you're an existing financial services partner that wants access, contact your local Partner Manager. If you're a financial institution who wants to provide bank feeds to your business customers, contact us to become a financial services partner.

diff --git a/docs/v4/files/index.html b/docs/v4/files/index.html
@@ -1107,7 +1107,7 @@ <h1>Xero Files API</h1>
             <h2 id="welcome-to-apidoc">API and SDK Documentation</h2>
               <div class="app-desc">Version: 1.0.0</div>
             <!--
-              <div class="app-desc">Version: 2.9.4</div>
+              <div class="app-desc">Version: 2.10.0</div>
             <hr>
             <div id="app-description" class="app-desc">
                 These endpoints are specific to Xero Files API

diff --git a/docs/v4/payroll-au/index.html b/docs/v4/payroll-au/index.html
@@ -3225,7 +3225,7 @@ <h1>Xero Payroll AU API</h1>
             <h2 id="welcome-to-apidoc">API and SDK Documentation</h2>
               <div class="app-desc">Version: 1.0.0</div>
             <!--
-              <div class="app-desc">Version: 2.9.4</div>
+              <div class="app-desc">Version: 2.10.0</div>
             <hr>
             <div id="app-description" class="app-desc">
                 This is the Xero Payroll API for orgs in Australia region.

diff --git a/docs/v4/payroll-uk/index.html b/docs/v4/payroll-uk/index.html
@@ -3621,7 +3621,7 @@ <h1>Xero Payroll UK</h1>
             <h2 id="welcome-to-apidoc">API and SDK Documentation</h2>
               <div class="app-desc">Version: 1.0.0</div>
             <!--
-              <div class="app-desc">Version: 2.9.4</div>
+              <div class="app-desc">Version: 2.10.0</div>
             <hr>
             <div id="app-description" class="app-desc">
                 This is the Xero Payroll API for orgs in the UK region.

diff --git a/docs/v4/projects/index.html b/docs/v4/projects/index.html
@@ -1412,7 +1412,7 @@ <h1>Xero Projects API</h1>
             <h2 id="welcome-to-apidoc">API and SDK Documentation</h2>
               <div class="app-desc">Version: 1.0.0</div>
             <!--
-              <div class="app-desc">Version: 2.9.4</div>
+              <div class="app-desc">Version: 2.10.0</div>
             <hr>
             <div id="app-description" class="app-desc">
                 This is the Xero Projects API

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "xero-node",
-  "version": "4.10.2",
+  "version": "4.10.3",
   "description": "Xero NodeJS OAuth 2.0 client for xero-node",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

diff --git a/src/XeroClient.ts b/src/XeroClient.ts
@@ -113,7 +113,7 @@ export class XeroClient {
 
   public async apiCallback(callbackUrl: string): Promise<TokenSet> {
     const params = this.openIdClient.callbackParams(callbackUrl);
-    const check = { ...params };
+    const check = { state: this.config.state };
     if (this.config.scopes.includes('openid')) {
       this._tokenSet = await this.openIdClient.callback(this.config.redirectUris[0], params, check);
     } else {

diff --git a/src/gen/api/accountingApi.ts b/src/gen/api/accountingApi.ts
@@ -68,7 +68,7 @@ export enum AccountingApiApiKeys {
 
 export class AccountingApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};
 

diff --git a/src/gen/api/assetApi.ts b/src/gen/api/assetApi.ts
@@ -23,7 +23,7 @@ export enum AssetApiApiKeys {
 
 export class AssetApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};
 

diff --git a/src/gen/api/bankfeedsApi.ts b/src/gen/api/bankfeedsApi.ts
@@ -22,7 +22,7 @@ export enum BankFeedsApiApiKeys {
 
 export class BankFeedsApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};
 

diff --git a/src/gen/api/filesApi.ts b/src/gen/api/filesApi.ts
@@ -23,7 +23,7 @@ export enum FilesApiApiKeys {
 
 export class FilesApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};
 

diff --git a/src/gen/api/payrollAUApi.ts b/src/gen/api/payrollAUApi.ts
@@ -39,7 +39,7 @@ export enum PayrollAuApiApiKeys {
 
 export class PayrollAuApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};
 

diff --git a/src/gen/api/payrollNZApi.ts b/src/gen/api/payrollNZApi.ts
@@ -80,7 +80,7 @@ export enum PayrollNzApiApiKeys {
 
 export class PayrollNzApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};
 

diff --git a/src/gen/api/payrollUKApi.ts b/src/gen/api/payrollUKApi.ts
@@ -80,7 +80,7 @@ export enum PayrollUkApiApiKeys {
 
 export class PayrollUkApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};
 

diff --git a/src/gen/api/projectApi.ts b/src/gen/api/projectApi.ts
@@ -29,7 +29,7 @@ export enum ProjectApiApiKeys {
 
 export class ProjectApi {
     protected _basePath = defaultBasePath;
-    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.2'};
+    protected defaultHeaders : any = {'user-agent': 'xero-node-4.10.3'};
     protected _useQuerystring : boolean = false;
     protected binaryHeaders : any = {};