diff options
| -rw-r--r-- | plugins/OpenID/openidserver.php | 88 |
1 files changed, 62 insertions, 26 deletions
diff --git a/plugins/OpenID/openidserver.php b/plugins/OpenID/openidserver.php index 8ffe979b0..dab97c93e 100644 --- a/plugins/OpenID/openidserver.php +++ b/plugins/OpenID/openidserver.php @@ -48,68 +48,104 @@ require_once(INSTALLDIR.'/plugins/OpenID/User_openid_trustroot.php'); */ class OpenidserverAction extends Action { + var $oserver; + + function prepare($args) + { + parent::prepare($args); + $this->oserver = oid_server(); + return true; + } function handle($args) { parent::handle($args); - $oserver = oid_server(); - $request = $oserver->decodeRequest(); + $request = $this->oserver->decodeRequest(); if (in_array($request->mode, array('checkid_immediate', 'checkid_setup'))) { - $cur = common_current_user(); - if(!$cur){ - /* Go log in, and then come back. */ - common_set_returnto($_SERVER['REQUEST_URI']); - common_redirect(common_local_url('login')); - return; - }else if(common_profile_url($cur->nickname) == $request->identity || $request->idSelect()){ + $user = common_current_user(); + if(!$user){ + if($request->immediate){ + //cannot prompt the user to login in immediate mode, so answer false + $response = $this->generateDenyResponse($request); + }else{ + /* Go log in, and then come back. */ + common_set_returnto($_SERVER['REQUEST_URI']); + common_redirect(common_local_url('login')); + return; + } + }else if(common_profile_url($user->nickname) == $request->identity || $request->idSelect()){ $user_openid_trustroot = User_openid_trustroot::pkeyGet( - array('user_id'=>$cur->id, 'trustroot'=>$request->trustroot)); + array('user_id'=>$user->id, 'trustroot'=>$request->trust_root)); if(empty($user_openid_trustroot)){ if($request->immediate){ //cannot prompt the user to trust this trust root in immediate mode, so answer false - $response = &$request->answer(false); + $response = $this->generateDenyResponse($request); }else{ - //ask the user to trust this trust root - $_SESSION['openid_trust_root'] = $request->trust_root; - $allowResponse = $request->answer(true, null, common_profile_url($cur->nickname)); - $denyResponse = $request->answer(false); common_ensure_session(); + $_SESSION['openid_trust_root'] = $request->trust_root; + $allowResponse = $this->generateAllowResponse($request, $user); + $this->oserver->encodeResponse($allowResponse); //sign the response + $denyResponse = $this->generateDenyResponse($request); + $this->oserver->encodeResponse($denyResponse); //sign the response $_SESSION['openid_allow_url'] = $allowResponse->encodeToUrl(); $_SESSION['openid_deny_url'] = $denyResponse->encodeToUrl(); + //ask the user to trust this trust root common_redirect(common_local_url('openidtrust')); return; } }else{ //user has previously authorized this trust root - $response = &$request->answer(true, null, common_profile_url($cur->nickname)); + $response = $this->generateAllowResponse($request, $user); + //$response = $request->answer(true, null, common_profile_url($user->nickname)); } } else if ($request->immediate) { - $response = &$request->answer(false); + $response = $this->generateDenyResponse($request); } else { //invalid $this->clientError(sprintf(_('You are not authorized to use the identity %s'),$request->identity),$code=403); } } else { - $response = &$oserver->handleRequest($request); + $response = $this->oserver->handleRequest($request); } if($response){ - $webresponse = $oserver->encodeResponse($response); - - if ($webresponse->code != AUTH_OPENID_HTTP_OK) { - header(sprintf("HTTP/1.1 %d ", $webresponse->code), - true, $webresponse->code); + $response = $this->oserver->encodeResponse($response); + if ($response->code != AUTH_OPENID_HTTP_OK) { + header(sprintf("HTTP/1.1 %d ", $response->code), + true, $response->code); } - if($webresponse->headers){ - foreach ($webresponse->headers as $k => $v) { + if($response->headers){ + foreach ($response->headers as $k => $v) { header("$k: $v"); } } - $this->raw($webresponse->body); + $this->raw($response->body); }else{ $this->clientError(_('Just an OpenID provider. Nothing to see here, move along...'),$code=500); } } + + function generateAllowResponse($request, $user){ + $response = $request->answer(true, null, common_profile_url($user->nickname)); + + $profile = $user->getProfile(); + $sreg_data = array( + 'fullname' => $profile->fullname, + 'nickname' => $user->nickname, + 'email' => $user->email, + 'language' => $user->language, + 'timezone' => $user->timezone); + $sreg_request = Auth_OpenID_SRegRequest::fromOpenIDRequest($request); + $sreg_response = Auth_OpenID_SRegResponse::extractResponse( + $sreg_request, $sreg_data); + $sreg_response->toMessage($response->fields); + return $response; + } + + function generateDenyResponse($request){ + $response = $request->answer(false); + return $response; + } } |