Skip to content

Conversation

@andersrehn
Copy link

This PR extends the scenarios where the OAuth response is to be considered an error. I have noticed that the Instagram OAuth could respond with a valid 200 but it contains an error inside.
If the response data payload is not properly checked to ensure there is a payload, other parts of the application will assume all went well.

Here is an example payload I got from the Instagram API when my token had expired.

{
    "error": {
        "message": "API access deactivated. To reactivate, go to the app dashboard.",
        "type": "OAuthException",
        "code": 200,
        "fbtrace_id": "......"
    }
}

When Instagram sends this payload the following piece of code tries to read undefined properties.
instagram-api/api.php:21 inside function instagram_get_user_items.

Tested on PHP 8.0

…ata payload to prevent PHP fatal crashes if the response is not complete.
@msigley
Copy link
Owner

msigley commented Sep 26, 2022

Thanks for the PR!

The bigger issue is access to the Facebook Graph API is now automatically deactivated when an unpublished app is inactive for a while. I wasn't able to find the exact details of this and if this inactivity is due to someone not logging into the app dashboard or API calls (I doubt the later but its possible on low traffic websites).

In the meantime, I'll merge this PR if you could make the requested change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants