summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormEDI <medi@milaro.net>2009-09-03 19:32:27 +0200
committerCraig Andrews <candrews@integralblue.com>2009-09-03 15:29:13 -0400
commit0d7d4dfe5d258d2018f601f8116d629577105864 (patch)
treed73c0664ac8d76b7006fc2374eb5a88e12401618
parent0c95734a6874608ea5ed44608cabeda7c3a1b4ea (diff)
add basic auth support for cgi servers on the api (trac #1832)
-rw-r--r--actions/api.php46
1 files changed, 41 insertions, 5 deletions
diff --git a/actions/api.php b/actions/api.php
index f425a8dcd..f624d6b69 100644
--- a/actions/api.php
+++ b/actions/api.php
@@ -27,6 +27,8 @@ class ApiAction extends Action
var $api_arg;
var $api_method;
var $api_action;
+ var $auth_user;
+ var $auth_pw;
function handle($args)
{
@@ -35,6 +37,7 @@ class ApiAction extends Action
$this->api_action = $this->arg('apiaction');
$method = $this->arg('method');
$argument = $this->arg('argument');
+ $this->basic_auth_process_header();
if (isset($argument)) {
$cmdext = explode('.', $argument);
@@ -50,7 +53,7 @@ class ApiAction extends Action
}
if ($this->requires_auth()) {
- if (!isset($_SERVER['PHP_AUTH_USER'])) {
+ if (!isset($this->auth_user)) {
# This header makes basic auth go
header('WWW-Authenticate: Basic realm="StatusNet API"');
@@ -58,8 +61,8 @@ class ApiAction extends Action
# If the user hits cancel -- bam!
$this->show_basic_auth_error();
} else {
- $nickname = $_SERVER['PHP_AUTH_USER'];
- $password = $_SERVER['PHP_AUTH_PW'];
+ $nickname = $this->auth_user;
+ $password = $this->auth_pw;
$user = common_check_user($nickname, $password);
if ($user) {
@@ -76,8 +79,8 @@ class ApiAction extends Action
} else {
// Caller might give us a username even if not required
- if (isset($_SERVER['PHP_AUTH_USER'])) {
- $user = User::staticGet('nickname', $_SERVER['PHP_AUTH_USER']);
+ if (isset($this->auth_user)) {
+ $user = User::staticGet('nickname', $this->auth_user);
if ($user) {
$this->user = $user;
}
@@ -203,6 +206,39 @@ class ApiAction extends Action
}
}
+ function basic_auth_process_header()
+ {
+ if(isset($_SERVER['AUTHORIZATION']) || isset($_SERVER['HTTP_AUTHORIZATION']))
+ {
+ $authorization_header = isset($_SERVER['HTTP_AUTHORIZATION'])?$_SERVER['HTTP_AUTHORIZATION']:$_SERVER['AUTHORIZATION'];
+ }
+
+ if(isset($_SERVER['PHP_AUTH_USER']))
+ {
+ $this->auth_user = $_SERVER['PHP_AUTH_USER'];
+ $this->auth_pw = $_SERVER['PHP_AUTH_PW'];
+ }
+ elseif ( isset($authorization_header) && strstr(substr($authorization_header, 0,5),'Basic') )
+ {
+ // decode the HTTP_AUTHORIZATION header on php-cgi server self
+ // on fcgid server is the header name AUTHORIZATION
+
+ $auth_hash = base64_decode( substr($authorization_header, 6) );
+ list($this->auth_user, $this->auth_pw) = explode(':', $auth_hash);
+
+ // set all to NULL on a emty basic auth request
+ if($this->auth_user == "") {
+ $this->auth_user = NULL;
+ $this->auth_pw = NULL;
+ }
+ }
+ else
+ {
+ $this->auth_user = NULL;
+ $this->auth_pw = NULL;
+ }
+ }
+
function show_basic_auth_error()
{
header('HTTP/1.1 401 Unauthorized');