openid.php 12.6 KB
Newer Older
1 2
<?php
/*
3
 * StatusNet - the distributed open-source microblogging tool
4
 * Copyright (C) 2008, 2009, StatusNet, Inc.
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

20 21 22
if (!defined('STATUSNET')) {
    exit(1);
}
23

24
require_once('Auth/OpenID.php');
25
require_once('Auth/OpenID/Consumer.php');
26
require_once('Auth/OpenID/Server.php');
27
require_once('Auth/OpenID/SReg.php');
28 29
require_once('Auth/OpenID/MySQLStore.php');

30
// About one year cookie expiry
31 32 33

define('OPENID_COOKIE_EXPIRY', round(365.25 * 24 * 60 * 60));
define('OPENID_COOKIE_KEY', 'lastusedopenid');
34

35 36
function oid_store()
{
Evan Prodromou's avatar
Evan Prodromou committed
37
    static $store = null;
38
    if (!$store) {
39
        // Can't be called statically
40 41 42 43 44
        $user = new User();
        $conn = $user->getDatabaseConnection();
        $store = new Auth_OpenID_MySQLStore($conn);
    }
    return $store;
45 46
}

47 48
function oid_consumer()
{
49 50 51
    $store = oid_store();
    $consumer = new Auth_OpenID_Consumer($store);
    return $consumer;
52 53
}

54 55 56 57 58 59 60
function oid_server()
{
    $store = oid_store();
    $server = new Auth_OpenID_Server($store, common_local_url('openidserver'));
    return $server;
}

61 62
function oid_clear_last()
{
63
    oid_set_last('');
64 65
}

66 67
function oid_set_last($openid_url)
{
68 69 70
    common_set_cookie(OPENID_COOKIE_KEY,
                     $openid_url,
                     time() + OPENID_COOKIE_EXPIRY);
71 72
}

73 74
function oid_get_last()
{
75 76 77
    if (empty($_COOKIE[OPENID_COOKIE_KEY])) {
        return null;
    }
78 79 80 81
    $openid_url = $_COOKIE[OPENID_COOKIE_KEY];
    if ($openid_url && strlen($openid_url) > 0) {
        return $openid_url;
    } else {
Evan Prodromou's avatar
Evan Prodromou committed
82
        return null;
83
    }
84 85
}

86 87
function oid_link_user($id, $canonical, $display)
{
88 89
    global $_PEAR;

90 91 92 93
    $oid = new User_openid();
    $oid->user_id = $id;
    $oid->canonical = $canonical;
    $oid->display = $display;
94
    $oid->created = common_sql_now();
Evan Prodromou's avatar
Evan Prodromou committed
95

96
    if (!$oid->insert()) {
97
        $err = &$_PEAR->getStaticProperty('DB_DataObject','lastError');
98 99
        return false;
    }
100

101
    return true;
102
}
103

104 105
function oid_get_user($openid_url)
{
Evan Prodromou's avatar
Evan Prodromou committed
106
    $user = null;
107
    $oid = User_openid::getKV('canonical', $openid_url);
108
    if ($oid) {
109
        $user = User::getKV('id', $oid->user_id);
110 111
    }
    return $user;
112 113
}

114 115
function oid_check_immediate($openid_url, $backto=null)
{
116 117 118 119 120 121 122 123 124 125 126 127 128 129
    if (!$backto) {
        $action = $_REQUEST['action'];
        $args = common_copy_args($_GET);
        unset($args['action']);
        $backto = common_local_url($action, $args);
    }

    common_ensure_session();

    $_SESSION['openid_immediate_backto'] = $backto;

    oid_authenticate($openid_url,
                     'finishimmediate',
                     true);
130 131
}

132 133
function oid_authenticate($openid_url, $returnto, $immediate=false)
{
134
    $openid_url = Auth_OpenID::normalizeUrl($openid_url);
135 136 137
    if (!common_valid_http_url($openid_url)) {
        throw new ClientException(_m('No valid URL provided for OpenID.'));
    }
138

139 140 141
    $consumer = oid_consumer();

    if (!$consumer) {
142
        // TRANS: OpenID plugin server error.
143
        throw new ServerException(_m('Cannot instantiate OpenID consumer object.'));
144 145 146 147 148 149 150 151
    }

    common_ensure_session();

    $auth_request = $consumer->begin($openid_url);

    // Handle failure status return values.
    if (!$auth_request) {
152
        common_log(LOG_ERR, __METHOD__ . ": mystery fail contacting $openid_url");
153
        // TRANS: OpenID plugin message. Given when an OpenID is not valid.
154
        throw new ServerException(_m('Not a valid OpenID.'));
155
    } else if (Auth_OpenID::isFailure($auth_request)) {
156
        common_log(LOG_ERR, __METHOD__ . ": OpenID fail to $openid_url: $auth_request->message");
157 158
        // TRANS: OpenID plugin server error. Given when the OpenID authentication request fails.
        // TRANS: %s is the failure message.
159
        throw new ServerException(sprintf(_m('OpenID failure: %s.'), $auth_request->message));
160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176
    }

    $sreg_request = Auth_OpenID_SRegRequest::build(// Required
                                                   array(),
                                                   // Optional
                                                   array('nickname',
                                                         'email',
                                                         'fullname',
                                                         'language',
                                                         'timezone',
                                                         'postcode',
                                                         'country'));

    if ($sreg_request) {
        $auth_request->addExtension($sreg_request);
    }

177 178 179 180 181 182 183 184 185
    $requiredTeam = common_config('openid', 'required_team');
    if ($requiredTeam) {
        // LaunchPad OpenID extension
        $team_request = new Auth_OpenID_TeamsRequest(array($requiredTeam));
        if ($team_request) {
            $auth_request->addExtension($team_request);
        }
    }

186
    $trust_root = common_root_url(true);
187 188
    $process_url = common_local_url($returnto);

189 190 191 192 193 194 195 196 197 198 199 200 201
    // Net::OpenID::Server as used on LiveJournal appears to incorrectly
    // reject POST requests for data submissions that OpenID 1.1 specs
    // as GET, although 2.0 allows them:
    // https://rt.cpan.org/Public/Bug/Display.html?id=42202
    //
    // Our OpenID libraries would have switched in the redirect automatically
    // if it were detecting 1.1 compatibility mode, however the server is
    // advertising itself as 2.0-compatible, so we got switched to the POST.
    //
    // Since the GET should always work anyway, we'll just take out the
    // autosubmitter for now.
    // 
    //if ($auth_request->shouldSendRedirect()) {
202 203 204
        $redirect_url = $auth_request->redirectURL($trust_root,
                                                   $process_url,
                                                   $immediate);
205
        if (Auth_OpenID::isFailure($redirect_url)) {
206 207
            // TRANS: OpenID plugin server error. Given when the OpenID authentication request cannot be redirected.
            // TRANS: %s is the failure message.
208
            throw new ServerException(sprintf(_m('Could not redirect to server: %s.'), $redirect_url->message));
209
        }
210
        common_redirect($redirect_url, 303);
211
    /*
212 213 214 215 216 217
    } else {
        // Generate form markup and render it.
        $form_id = 'openid_message';
        $form_html = $auth_request->formMarkup($trust_root, $process_url,
                                               $immediate, array('id' => $form_id));

218 219
        // XXX: This is cheap, but things choke if we don't escape ampersands
        // in the HTML attributes
220 221 222

        $form_html = preg_replace('/&/', '&amp;', $form_html);

223
        // Display an error if the form markup couldn't be generated;
224 225
        // otherwise, render the HTML.
        if (Auth_OpenID::isFailure($form_html)) {
226 227
            // TRANS: OpenID plugin server error if the form markup could not be generated.
            // TRANS: %s is the failure message.
228
            common_server_error(sprintf(_m('Could not create OpenID form: %s'), $form_html->message));
229
        } else {
230 231 232 233 234
            $action = new AutosubmitAction(); // see below
            $action->form_html = $form_html;
            $action->form_id = $form_id;
            $action->prepare(array('action' => 'autosubmit'));
            $action->handle(array('action' => 'autosubmit'));
235 236
        }
    }
237
    */
238
}
239

240
// Half-assed attempt at a module-private function
241

242 243
function _oid_print_instructions()
{
244
    common_element('div', 'instructions',
245
                   // TRANS: OpenID plugin user instructions.
246
                   _m('This form should automatically submit itself. '.
247 248
                      'If not, click the submit button to go to your '.
                      'OpenID provider.'));
249 250
}

251 252 253 254 255 256 257
/**
 * Update a user from sreg parameters
 * @param User $user
 * @param array $sreg fields from OpenID sreg response
 * @access private
 */
function oid_update_user($user, $sreg)
258
{
259
    $profile = $user->getProfile();
260

261
    $orig_profile = clone($profile);
262

Brion Vibber's avatar
Brion Vibber committed
263
    if (!empty($sreg['fullname']) && strlen($sreg['fullname']) <= 255) {
264 265
        $profile->fullname = $sreg['fullname'];
    }
266

Brion Vibber's avatar
Brion Vibber committed
267
    if (!empty($sreg['country'])) {
268
        if ($sreg['postcode']) {
269 270
            // XXX: use postcode to get city and region
            // XXX: also, store postcode somewhere -- it's valuable!
271 272 273 274 275
            $profile->location = $sreg['postcode'] . ', ' . $sreg['country'];
        } else {
            $profile->location = $sreg['country'];
        }
    }
276

277 278
    // XXX save language if it's passed
    // XXX save timezone if it's passed
279

280
    if (!$profile->update($orig_profile)) {
281
        // TRANS: OpenID plugin server error.
282
        common_server_error(_m('Error saving the profile.'));
283 284
        return false;
    }
285

286
    $orig_user = clone($user);
287

Brion Vibber's avatar
Brion Vibber committed
288
    if (!empty($sreg['email']) && Validate::email($sreg['email'], common_config('email', 'check_domain'))) {
289 290
        $user->email = $sreg['email'];
    }
291

292
    if (!$user->update($orig_user)) {
293
        // TRANS: OpenID plugin server error.
294
        common_server_error(_m('Error saving the user.'));
295 296
        return false;
    }
297

298
    return true;
299
}
300

301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322
function oid_assert_allowed($url)
{
    $blacklist = common_config('openid', 'blacklist');
    $whitelist = common_config('openid', 'whitelist');

    if (empty($blacklist)) {
        $blacklist = array();
    }

    if (empty($whitelist)) {
        $whitelist = array();
    }

    foreach ($blacklist as $pattern) {
        if (preg_match("/$pattern/", $url)) {
            common_log(LOG_INFO, "Matched OpenID blacklist pattern {$pattern} with {$url}");
            foreach ($whitelist as $exception) {
                if (preg_match("/$exception/", $url)) {
                    common_log(LOG_INFO, "Matched OpenID whitelist pattern {$exception} with {$url}");
                    return;
                }
            }
323
            // TRANS: OpenID plugin client exception (403).
324
            throw new ClientException(_m('Unauthorized URL used for OpenID login.'), 403);
325 326 327 328 329 330
        }
    }

    return;
}

331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357
/**
 * Check the teams available in the given OpenID response
 * Using Launchpad's OpenID teams extension
 *
 * @return boolean whether this user is acceptable
 */
function oid_check_teams($response)
{
    $requiredTeam = common_config('openid', 'required_team');
    if ($requiredTeam) {
        $team_resp = new Auth_OpenID_TeamsResponse($response);
        if ($team_resp) {
            $teams = $team_resp->getTeams();
        } else {
            $teams = array();
        }

        $match = in_array($requiredTeam, $teams);
        $is = $match ? 'is' : 'is not';
        common_log(LOG_DEBUG, "Remote user $is in required team $requiredTeam: [" . implode(', ', $teams) . "]");

        return $match;
    }

    return true;
}

358 359 360 361 362 363 364 365 366 367 368 369 370
class AutosubmitAction extends Action
{
    var $form_html = null;
    var $form_id = null;

    function handle($args)
    {
        parent::handle($args);
        $this->showPage();
    }

    function title()
    {
371
        // TRANS: Title
372
        return _m('OpenID Login Submission');
373 374 375 376
    }

    function showContent()
    {
377
        $this->raw('<p style="margin: 20px 80px">');
378
        // @todo FIXME: This would be better using standard CSS class, but the present theme's a bit scary.
379 380 381
        $this->element('img', array('src' => Theme::path('images/icons/icon_processing.gif', 'base'),
                                    // for some reason the base CSS sets <img>s as block display?!
                                    'style' => 'display: inline'));
382
        // TRANS: OpenID plugin message used while requesting authorization user's OpenID login provider.
383 384 385
        $this->text(_m('Requesting authorization from your login provider...'));
        $this->raw('</p>');
        $this->raw('<p style="margin-top: 60px; font-style: italic">');
386
        // TRANS: OpenID plugin message. User instruction while requesting authorization user's OpenID login provider.
387 388
        $this->text(_m('If you are not redirected to your login provider in a few seconds, try pushing the button below.'));
        $this->raw('</p>');
389
        $this->raw($this->form_html);
390
    }
Evan Prodromou's avatar
Evan Prodromou committed
391

392 393 394
    function showScripts()
    {
        parent::showScripts();
395
        $this->element('script', null,
396
                       'document.getElementById(\'' . $this->form_id . '\').submit();');
397 398
    }
}