openidserver.php 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160
  1. <?php
  2. /**
  3. * StatusNet, the distributed open-source microblogging tool
  4. *
  5. * Settings for OpenID
  6. *
  7. * PHP version 5
  8. *
  9. * LICENCE: This program is free software: you can redistribute it and/or modify
  10. * it under the terms of the GNU Affero General Public License as published by
  11. * the Free Software Foundation, either version 3 of the License, or
  12. * (at your option) any later version.
  13. *
  14. * This program is distributed in the hope that it will be useful,
  15. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. * GNU Affero General Public License for more details.
  18. *
  19. * You should have received a copy of the GNU Affero General Public License
  20. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  21. *
  22. * @category Settings
  23. * @package StatusNet
  24. * @author Craig Andrews <candrews@integralblue.com>
  25. * @copyright 2008-2009 StatusNet, Inc.
  26. * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  27. * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  28. * @link http://status.net/
  29. */
  30. if (!defined('STATUSNET')) {
  31. exit(1);
  32. }
  33. require_once INSTALLDIR.'/plugins/OpenID/openid.php';
  34. /**
  35. * Settings for OpenID
  36. *
  37. * Lets users add, edit and delete OpenIDs from their account
  38. *
  39. * @category Settings
  40. * @package StatusNet
  41. * @author Craig Andrews <candrews@integralblue.com>
  42. * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  43. * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  44. * @link http://status.net/
  45. */
  46. class OpenidserverAction extends Action
  47. {
  48. var $oserver;
  49. function prepare(array $args = array())
  50. {
  51. parent::prepare($args);
  52. $this->oserver = oid_server();
  53. return true;
  54. }
  55. function handle()
  56. {
  57. parent::handle();
  58. $request = $this->oserver->decodeRequest();
  59. if (in_array($request->mode, array('checkid_immediate',
  60. 'checkid_setup'))) {
  61. if (!$this->scoped instanceof Profile) {
  62. if($request->immediate){
  63. //cannot prompt the user to login in immediate mode, so answer false
  64. $response = $this->generateDenyResponse($request);
  65. }else{
  66. // Go log in, and then come back.
  67. //
  68. // Note: 303 redirect rather than 307 to avoid
  69. // prompting user for form resubmission if we
  70. // were POSTed here.
  71. common_set_returnto($_SERVER['REQUEST_URI']);
  72. common_redirect(common_local_url('login'), 303);
  73. }
  74. } elseif (in_array($request->identity, $this->scoped->getAliases()) || $request->idSelect()) {
  75. $user_openid_trustroot = User_openid_trustroot::pkeyGet(
  76. array('user_id'=>$this->scoped->getID(), 'trustroot'=>$request->trust_root));
  77. if(empty($user_openid_trustroot)){
  78. if($request->immediate){
  79. //cannot prompt the user to trust this trust root in immediate mode, so answer false
  80. $response = $this->generateDenyResponse($request);
  81. }else{
  82. common_ensure_session();
  83. $_SESSION['openid_trust_root'] = $request->trust_root;
  84. $allowResponse = $this->generateAllowResponse($request, $this->scoped);
  85. $this->oserver->encodeResponse($allowResponse); //sign the response
  86. $denyResponse = $this->generateDenyResponse($request);
  87. $this->oserver->encodeResponse($denyResponse); //sign the response
  88. $_SESSION['openid_allow_url'] = $allowResponse->encodeToUrl();
  89. $_SESSION['openid_deny_url'] = $denyResponse->encodeToUrl();
  90. // Ask the user to trust this trust root...
  91. //
  92. // Note: 303 redirect rather than 307 to avoid
  93. // prompting user for form resubmission if we
  94. // were POSTed here.
  95. common_redirect(common_local_url('openidtrust'), 303);
  96. }
  97. } else {
  98. //user has previously authorized this trust root
  99. $response = $this->generateAllowResponse($request, $this->scoped);
  100. }
  101. } elseif ($request->immediate) {
  102. $response = $this->generateDenyResponse($request);
  103. } else {
  104. //invalid
  105. // TRANS: OpenID plugin client error given trying to add an unauthorised OpenID to a user (403).
  106. // TRANS: %s is a request identity.
  107. $this->clientError(sprintf(_m('You are not authorized to use the identity %s.'),$request->identity),$code=403);
  108. }
  109. } else {
  110. $response = $this->oserver->handleRequest($request);
  111. }
  112. if($response){
  113. $response = $this->oserver->encodeResponse($response);
  114. if ($response->code != AUTH_OPENID_HTTP_OK) {
  115. header(sprintf("HTTP/1.1 %d ", $response->code),
  116. true, $response->code);
  117. }
  118. if($response->headers){
  119. foreach ($response->headers as $k => $v) {
  120. header("$k: $v");
  121. }
  122. }
  123. $this->raw($response->body);
  124. }else{
  125. // TRANS: OpenID plugin client error given when not getting a response for a given OpenID provider (500).
  126. $this->clientError(_m('Just an OpenID provider. Nothing to see here, move along...'),$code=500);
  127. }
  128. }
  129. function generateAllowResponse($request, Profile $profile){
  130. $response = $request->answer(true, null, $profile->getUrl());
  131. $user = $profile->getUser();
  132. $sreg_data = array(
  133. 'fullname' => $profile->getFullname(),
  134. 'nickname' => $profile->getNickname(),
  135. 'email' => $user->email, // FIXME: Should we make the email optional?
  136. 'language' => $user->language,
  137. 'timezone' => $user->timezone);
  138. $sreg_request = Auth_OpenID_SRegRequest::fromOpenIDRequest($request);
  139. $sreg_response = Auth_OpenID_SRegResponse::extractResponse(
  140. $sreg_request, $sreg_data);
  141. $sreg_response->toMessage($response->fields);
  142. return $response;
  143. }
  144. function generateDenyResponse($request){
  145. $response = $request->answer(false);
  146. return $response;
  147. }
  148. }