showapplication.php 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368
  1. <?php
  2. /**
  3. * StatusNet, the distributed open-source microblogging tool
  4. *
  5. * Show an OAuth application
  6. *
  7. * PHP version 5
  8. *
  9. * LICENCE: This program is free software: you can redistribute it and/or modify
  10. * it under the terms of the GNU Affero General Public License as published by
  11. * the Free Software Foundation, either version 3 of the License, or
  12. * (at your option) any later version.
  13. *
  14. * This program is distributed in the hope that it will be useful,
  15. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. * GNU Affero General Public License for more details.
  18. *
  19. * You should have received a copy of the GNU Affero General Public License
  20. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  21. *
  22. * @category Application
  23. * @package StatusNet
  24. * @author Zach Copley <zach@status.net>
  25. * @copyright 2008-2011 StatusNet, Inc.
  26. * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  27. * @link http://status.net/
  28. */
  29. if (!defined('STATUSNET') && !defined('LACONICA')) {
  30. exit(1);
  31. }
  32. /**
  33. * Show an OAuth application
  34. *
  35. * @category Application
  36. * @package StatusNet
  37. * @author Zach Copley <zach@status.net>
  38. * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  39. * @link http://status.net/
  40. */
  41. class ShowApplicationAction extends Action
  42. {
  43. /**
  44. * Application to show
  45. */
  46. var $application = null;
  47. /**
  48. * User who owns the app
  49. */
  50. var $owner = null;
  51. var $msg = null;
  52. var $success = null;
  53. /**
  54. * Load attributes based on database arguments
  55. *
  56. * Loads all the DB stuff
  57. *
  58. * @param array $args $_REQUEST array
  59. *
  60. * @return success flag
  61. */
  62. function prepare($args)
  63. {
  64. parent::prepare($args);
  65. $id = (int)$this->arg('id');
  66. $this->application = Oauth_application::getKV($id);
  67. $this->owner = User::getKV($this->application->owner);
  68. if (!common_logged_in()) {
  69. // TRANS: Client error displayed trying to display an OAuth application while not logged in.
  70. $this->clientError(_('You must be logged in to view an application.'));
  71. }
  72. if (empty($this->application)) {
  73. // TRANS: Client error displayed trying to display a non-existing OAuth application.
  74. $this->clientError(_('No such application.'), 404);
  75. }
  76. $cur = common_current_user();
  77. if ($cur->id != $this->owner->id) {
  78. // TRANS: Client error displayed trying to display an OAuth application for which the logged in user is not the owner.
  79. $this->clientError(_('You are not the owner of this application.'), 401);
  80. }
  81. return true;
  82. }
  83. /**
  84. * Handle the request
  85. *
  86. * Shows info about the app
  87. *
  88. * @return void
  89. */
  90. function handle($args)
  91. {
  92. parent::handle($args);
  93. if ($_SERVER['REQUEST_METHOD'] == 'POST') {
  94. // CSRF protection
  95. $token = $this->trimmed('token');
  96. if (!$token || $token != common_session_token()) {
  97. // TRANS: Client error displayed when the session token does not match or is not given.
  98. $this->clientError(_('There was a problem with your session token.'));
  99. }
  100. if ($this->arg('reset')) {
  101. $this->resetKey();
  102. }
  103. } else {
  104. $this->showPage();
  105. }
  106. }
  107. /**
  108. * Title of the page
  109. *
  110. * @return string title of the page
  111. */
  112. function title()
  113. {
  114. if (!empty($this->application->name)) {
  115. return 'Application: ' . $this->application->name;
  116. }
  117. }
  118. function showPageNotice()
  119. {
  120. if (!empty($this->msg)) {
  121. $this->element('div', ($this->success) ? 'success' : 'error', $this->msg);
  122. }
  123. }
  124. function showContent()
  125. {
  126. $cur = common_current_user();
  127. $consumer = $this->application->getConsumer();
  128. $this->elementStart('div', 'entity_profile h-card');
  129. // TRANS: Header on the OAuth application page.
  130. $this->element('h2', null, _('Application profile'));
  131. if (!empty($this->application->icon)) {
  132. $this->element('img', array('src' => $this->application->icon,
  133. 'class' => 'u-photo logo entity_depiction'));
  134. }
  135. $this->element('a', array('href' => $this->application->source_url,
  136. 'class' => 'u-url p-name entity_fn'),
  137. $this->application->name);
  138. $this->element('a', array('href' => $this->application->homepage,
  139. 'class' => 'u-url entity_org'),
  140. $this->application->organization);
  141. $this->element('div',
  142. 'note entity_note',
  143. $this->application->description);
  144. $this->elementStart('div', 'entity_statistics');
  145. $defaultAccess = ($this->application->access_type & Oauth_application::$writeAccess)
  146. ? 'read-write' : 'read-only';
  147. $profile = Profile::getKV($this->application->owner);
  148. $appUsers = new Oauth_application_user();
  149. $appUsers->application_id = $this->application->id;
  150. $userCnt = $appUsers->count();
  151. $this->raw(sprintf(
  152. // TRANS: Information output on an OAuth application page.
  153. // TRANS: %1$s is the application creator, %2$s is "read-only" or "read-write",
  154. // TRANS: %3$d is the number of users using the OAuth application.
  155. _m('Created by %1$s - %2$s access by default - %3$d user',
  156. 'Created by %1$s - %2$s access by default - %3$d users',
  157. $userCnt),
  158. $profile->getBestName(),
  159. $defaultAccess,
  160. $userCnt
  161. ));
  162. $this->elementEnd('div');
  163. $this->elementEnd('div');
  164. $this->elementStart('div', 'entity_actions');
  165. // TRANS: Header on the OAuth application page.
  166. $this->element('h2', null, _('Application actions'));
  167. $this->elementStart('ul');
  168. $this->elementStart('li', 'entity_edit');
  169. $this->element('a',
  170. array('href' => common_local_url('editapplication',
  171. array('id' => $this->application->id))),
  172. // TRANS: Link text to edit application on the OAuth application page.
  173. _m('EDITAPP','Edit'));
  174. $this->elementEnd('li');
  175. $this->elementStart('li', 'entity_reset_keysecret');
  176. $this->elementStart('form', array(
  177. 'id' => 'form_reset_key',
  178. 'class' => 'form_reset_key',
  179. 'method' => 'POST',
  180. 'action' => common_local_url('showapplication',
  181. array('id' => $this->application->id))));
  182. $this->elementStart('fieldset');
  183. $this->hidden('token', common_session_token());
  184. $this->element('input', array('type' => 'submit',
  185. 'id' => 'reset',
  186. 'name' => 'reset',
  187. 'class' => 'submit',
  188. // TRANS: Button text on the OAuth application page.
  189. // TRANS: Resets the OAuth consumer key and secret.
  190. 'value' => _('Reset key & secret'),
  191. 'onClick' => 'return confirmReset()'));
  192. $this->elementEnd('fieldset');
  193. $this->elementEnd('form');
  194. $this->elementEnd('li');
  195. $this->elementStart('li', 'entity_delete');
  196. $this->elementStart('form', array(
  197. 'id' => 'form_delete_application',
  198. 'class' => 'form_delete_application',
  199. 'method' => 'POST',
  200. 'action' => common_local_url('deleteapplication',
  201. array('id' => $this->application->id))));
  202. $this->elementStart('fieldset');
  203. $this->hidden('token', common_session_token());
  204. // TRANS: Submit button text the OAuth application page to delete an application.
  205. $this->submit('delete', _m('BUTTON','Delete'));
  206. $this->elementEnd('fieldset');
  207. $this->elementEnd('form');
  208. $this->elementEnd('li');
  209. $this->elementEnd('ul');
  210. $this->elementEnd('div');
  211. $this->elementStart('div', 'entity_data');
  212. // TRANS: Header on the OAuth application page.
  213. $this->element('h2', null, _('Application info'));
  214. $this->elementStart('dl');
  215. // TRANS: Field label on application page.
  216. $this->element('dt', null, _('Consumer key'));
  217. $this->element('dd', null, $consumer->consumer_key);
  218. // TRANS: Field label on application page.
  219. $this->element('dt', null, _('Consumer secret'));
  220. $this->element('dd', null, $consumer->consumer_secret);
  221. // TRANS: Field label on application page.
  222. $this->element('dt', null, _('Request token URL'));
  223. $this->element('dd', null, common_local_url('ApiOAuthRequestToken'));
  224. // TRANS: Field label on application page.
  225. $this->element('dt', null, _('Access token URL'));
  226. $this->element('dd', null, common_local_url('ApiOAuthAccessToken'));
  227. // TRANS: Field label on application page.
  228. $this->element('dt', null, _('Authorize URL'));
  229. $this->element('dd', null, common_local_url('ApiOAuthAuthorize'));
  230. $this->elementEnd('dl');
  231. $this->element('p', 'note',
  232. // TRANS: Note on the OAuth application page about signature support.
  233. _('Note: HMAC-SHA1 signatures are supported. The plaintext signature method is not supported.'));
  234. $this->elementEnd('div');
  235. $this->elementStart('p', array('id' => 'application_action'));
  236. $this->element('a',
  237. array('href' => common_local_url('oauthappssettings'),
  238. 'class' => 'more'),
  239. 'View your applications');
  240. $this->elementEnd('p');
  241. }
  242. /**
  243. * Add a confirm script for Consumer key/secret reset
  244. *
  245. * @return void
  246. */
  247. function showScripts()
  248. {
  249. parent::showScripts();
  250. // TRANS: Text in confirmation dialog to reset consumer key and secret for an OAuth application.
  251. $msg = _('Are you sure you want to reset your consumer key and secret?');
  252. $js = 'function confirmReset() { ';
  253. $js .= ' var agree = confirm("' . $msg . '"); ';
  254. $js .= ' return agree;';
  255. $js .= '}';
  256. $this->inlineScript($js);
  257. }
  258. /**
  259. * Reset an application's Consumer key and secret
  260. *
  261. * XXX: Should this be moved to its own page with a confirm?
  262. *
  263. */
  264. function resetKey()
  265. {
  266. $this->application->query('BEGIN');
  267. $oauser = new Oauth_application_user();
  268. $oauser->application_id = $this->application->id;
  269. $result = $oauser->delete();
  270. if ($result === false) {
  271. common_log_db_error($oauser, 'DELETE', __FILE__);
  272. $this->success = false;
  273. $this->msg = ('Unable to reset consumer key and secret.');
  274. $this->showPage();
  275. return;
  276. }
  277. $consumer = $this->application->getConsumer();
  278. $result = $consumer->delete();
  279. if ($result === false) {
  280. common_log_db_error($consumer, 'DELETE', __FILE__);
  281. $this->success = false;
  282. $this->msg = ('Unable to reset consumer key and secret.');
  283. $this->showPage();
  284. return;
  285. }
  286. $consumer = Consumer::generateNew();
  287. $result = $consumer->insert();
  288. if (empty($result)) {
  289. common_log_db_error($consumer, 'INSERT', __FILE__);
  290. $this->application->query('ROLLBACK');
  291. $this->success = false;
  292. $this->msg = ('Unable to reset consumer key and secret.');
  293. $this->showPage();
  294. return;
  295. }
  296. $orig = clone($this->application);
  297. $this->application->consumer_key = $consumer->consumer_key;
  298. $result = $this->application->update($orig);
  299. if ($result === false) {
  300. common_log_db_error($application, 'UPDATE', __FILE__);
  301. $this->application->query('ROLLBACK');
  302. $this->success = false;
  303. $this->msg = ('Unable to reset consumer key and secret.');
  304. $this->showPage();
  305. return;
  306. }
  307. $this->application->query('COMMIT');
  308. $this->success = true;
  309. $this->msg = ('Consumer key and secret reset.');
  310. $this->showPage();
  311. }
  312. }