From 6472331be51bc6d0e670603b2a89fb66022f6b51 Mon Sep 17 00:00:00 2001
From: Zach Copley <zach@status.net>
Date: Thu, 7 Jan 2010 13:19:21 -0800
Subject: Stubs for API OAuth token exchange stuff

---
 actions/apioauthauthorize.php | 49 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 actions/apioauthauthorize.php

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
new file mode 100644
index 000000000..8839d9571
--- /dev/null
+++ b/actions/apioauthauthorize.php
@@ -0,0 +1,49 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Authorize an OAuth request token
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  API
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+require_once INSTALLDIR . '/lib/api.php';
+
+/**
+ * Authorize an OAuth request token
+ *
+ * @category API
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class ApiOauthAuthorizeAction extends Action
+{
+
+}
-- 
cgit v1.2.3-54-g00ecf


From e9e448bcee69b0c39badf353faedb4c29af3f502 Mon Sep 17 00:00:00 2001
From: Zach Copley <zach@status.net>
Date: Sun, 10 Jan 2010 21:35:46 -0800
Subject: Workflow for request tokens and authorizing request tokens

---
 actions/apioauthauthorize.php    | 326 ++++++++++++++++++++++++++++++++++++++-
 actions/apioauthrequesttoken.php |   5 +-
 actions/showapplication.php      |   6 +-
 lib/router.php                   |  19 +--
 4 files changed, 338 insertions(+), 18 deletions(-)

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index 8839d9571..895a0c6e5 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/api.php';
+require_once INSTALLDIR . '/lib/apioauthstore.php';
 
 /**
  * Authorize an OAuth request token
@@ -45,5 +45,329 @@ require_once INSTALLDIR . '/lib/api.php';
 
 class ApiOauthAuthorizeAction extends Action
 {
+    var $oauth_token;
+    var $callback;
+    var $app;
+    var $nickname;
+    var $password;
+    var $store;
+
+    /**
+     * Is this a read-only action?
+     *
+     * @return boolean false
+     */
+
+    function isReadOnly($args)
+    {
+        return false;
+    }
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+
+        common_debug(var_export($_REQUEST, true));
+
+        $this->nickname    = $this->trimmed('nickname');
+        $this->password    = $this->arg('password');
+        $this->oauth_token = $this->arg('oauth_token');
+        $this->callback    = $this->arg('oauth_callback');
+        $this->store       = new ApiStatusNetOAuthDataStore();
+
+        return true;
+    }
+
+    function getApp()
+    {
+        // Look up the full req token
+
+        $req_token = $this->store->lookup_token(null,
+                                                'request',
+                                                $this->oauth_token);
+
+        if (empty($req_token)) {
+
+            common_debug("Couldn't find request token!");
+
+            $this->clientError(_('Bad request.'));
+            return;
+        }
+
+        // Look up the app
+
+        $app = new Oauth_application();
+        $app->consumer_key = $req_token->consumer_key;
+        $result = $app->find(true);
+
+        if (!empty($result)) {
+            $this->app = $app;
+            return true;
+
+        } else {
+            common_debug("couldn't find the app!");
+            return false;
+        }
+    }
+
+    /**
+     * Handle input, produce output
+     *
+     * Switches on request method; either shows the form or handles its input.
+     *
+     * @param array $args $_REQUEST data
+     *
+     * @return void
+     */
+
+    function handle($args)
+    {
+        parent::handle($args);
+
+        if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+            /* Use a session token for CSRF protection. */
+            $token = $this->trimmed('token');
+            if (!$token || $token != common_session_token()) {
+                $this->showForm(_('There was a problem with your session token. '.
+                                  'Try again, please.'));
+                return;
+            }
+
+            $this->handlePost();
+
+        } else {
+
+            common_debug('ApiOauthAuthorize::handle()');
+
+            if (empty($this->oauth_token)) {
+
+                common_debug("No request token found.");
+
+                $this->clientError(_('Bad request.'));
+                return;
+            }
+
+            if (!$this->getApp()) {
+                $this->clientError(_('Bad request.'));
+                return;
+            }
+
+            common_debug("Requesting auth for app: $app->name.");
+
+            $this->showForm();
+        }
+    }
+
+    function handlePost()
+    {
+        /* Use a session token for CSRF protection. */
+
+        $token = $this->trimmed('token');
+
+        if (!$token || $token != common_session_token()) {
+            $this->showForm(_('There was a problem with your session token. '.
+                              'Try again, please.'));
+            return;
+        }
+
+        if (!$this->getApp()) {
+            $this->clientError(_('Bad request.'));
+            return;
+        }
+
+        // is the user already logged in?
+
+        // check creds
+
+        if (!common_logged_in()) {
+            $user = common_check_user($this->nickname, $this->password);
+            if (empty($user)) {
+                $this->showForm(_("Invalid nickname / password!"));
+                return;
+            }
+        }
+
+        if ($this->arg('allow')) {
+
+            $this->store->authorize_token($this->oauth_token);
+
+            // if we have a callback redirect and provide the token
+
+            if (!empty($this->callback)) {
+                $target_url = $this->callback . '?oauth_token=' . $this->oauth_token;
+                common_redirect($target_url, 303);
+            }
+
+            // otherwise inform the user that the rt was authorized
+
+            $this->elementStart('p');
+
+            // XXX: Do verifier code?
+
+            $this->raw(sprintf(_("The request token %s has been authorized. " .
+                                 'Please exchange it for an access token.'),
+                               $this->oauth_token));
+
+            $this->elementEnd('p');
+
+        } else if ($this->arg('deny')) {
+
+            $this->elementStart('p');
+
+            $this->raw(sprintf(_("The request token %s has been denied."),
+                               $this->oauth_token));
+
+            $this->elementEnd('p');
+        } else {
+            $this->clientError(_('Unexpected form submission.'));
+            return;
+        }
+    }
+
+    function showForm($error=null)
+    {
+        $this->error = $error;
+        $this->showPage();
+    }
+
+    function showScripts()
+    {
+        parent::showScripts();
+      //  $this->autofocus('nickname');
+    }
+
+    /**
+     * Title of the page
+     *
+     * @return string title of the page
+     */
+
+    function title()
+    {
+        return _('An application would like to connect to your account');
+    }
+
+    /**
+     * Show page notice
+     *
+     * Display a notice for how to use the page, or the
+     * error if it exists.
+     *
+     * @return void
+     */
+
+    function showPageNotice()
+    {
+        if ($this->error) {
+            $this->element('p', 'error', $this->error);
+        } else {
+            $instr  = $this->getInstructions();
+            $output = common_markup_to_html($instr);
+
+            $this->raw($output);
+        }
+    }
+
+    /**
+     * Shows the authorization form.
+     *
+     * @return void
+     */
+
+    function showContent()
+    {
+        $this->elementStart('form', array('method' => 'post',
+                                           'id' => 'form_login',
+                                           'class' => 'form_settings',
+                                           'action' => common_local_url('apioauthauthorize')));
+
+        $this->hidden('token', common_session_token());
+        $this->hidden('oauth_token', $this->oauth_token);
+        $this->hidden('oauth_callback', $this->callback);
+
+        $this->elementStart('fieldset');
+
+        $this->elementStart('ul');
+        $this->elementStart('li');
+        if (!empty($this->app->icon)) {
+            $this->element('img', array('src' => $this->app->icon));
+        }
+        $this->elementEnd('li');
+        $this->elementStart('li');
+
+        $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
+          'access and update' : 'access';
+
+        $msg = _("The application <b>%s</b> by <b>%s</b> would like " .
+                 "the ability to <b>%s</b> your account data.");
+
+        $this->raw(sprintf($msg,
+                           $this->app->name,
+                           $this->app->organization,
+                           $access));
+
+        $this->elementEnd('li');
+        $this->elementEnd('ul');
+
+        $this->elementEnd('fieldset');
+
+        if (!common_logged_in()) {
+
+            $this->elementStart('fieldset');
+            $this->element('legend', null, _('Login'));
+            $this->elementStart('ul', 'form_data');
+            $this->elementStart('li');
+            $this->input('nickname', _('Nickname'));
+            $this->elementEnd('li');
+            $this->elementStart('li');
+            $this->password('password', _('Password'));
+            $this->elementEnd('li');
+            $this->elementEnd('ul');
+
+            $this->elementEnd('fieldset');
+
+        }
+
+        $this->element('input', array('id' => 'deny_submit',
+                                      'class' => 'submit',
+                                      'name' => 'deny',
+                                      'type' => 'submit',
+                                      'value' => _('Deny')));
+
+        $this->element('input', array('id' => 'allow_submit',
+                                      'class' => 'submit',
+                                      'name' => 'allow',
+                                      'type' => 'submit',
+                                      'value' => _('Allow')));
+
+        $this->elementEnd('form');
+    }
+
+    /**
+     * Instructions for using the form
+     *
+     * For "remembered" logins, we make the user re-login when they
+     * try to change settings. Different instructions for this case.
+     *
+     * @return void
+     */
+
+    function getInstructions()
+    {
+        return _('Allow or deny access to your account information.');
+
+    }
+
+    /**
+     * A local menu
+     *
+     * Shows different login/register actions.
+     *
+     * @return void
+     */
+
+    function showLocalNav()
+    {
+    }
 
 }
diff --git a/actions/apioauthrequesttoken.php b/actions/apioauthrequesttoken.php
index 1bbd7d295..53aca6b96 100644
--- a/actions/apioauthrequesttoken.php
+++ b/actions/apioauthrequesttoken.php
@@ -31,7 +31,6 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/api.php';
 require_once INSTALLDIR . '/lib/apioauthstore.php';
 
 /**
@@ -70,6 +69,7 @@ class ApiOauthRequestTokenAction extends Action
         $datastore   = new ApiStatusNetOAuthDataStore();
         $server      = new OAuthServer($datastore);
         $hmac_method = new OAuthSignatureMethod_HMAC_SHA1();
+
         $server->add_signature_method($hmac_method);
 
         try {
@@ -77,8 +77,7 @@ class ApiOauthRequestTokenAction extends Action
             $token = $server->fetch_request_token($req);
             print $token;
         } catch (OAuthException $e) {
-            common_log(LOG_WARN, $e->getMessage());
-            common_debug(var_export($req, true));
+            common_log(LOG_WARN, 'API OAuthException - ' . $e->getMessage());
             header('HTTP/1.1 401 Unauthorized');
             header('Content-Type: text/html; charset=utf-8');
             print $e->getMessage() . "\n";
diff --git a/actions/showapplication.php b/actions/showapplication.php
index 6d19b9561..5156fa6f0 100644
--- a/actions/showapplication.php
+++ b/actions/showapplication.php
@@ -231,17 +231,17 @@ class ShowApplicationAction extends OwnerDesignAction
 
         $this->elementStart('dl', 'entity_request_token_url');
         $this->element('dt', null, _('Request token URL'));
-        $this->element('dd', 'label', common_local_url('oauthrequesttoken'));
+        $this->element('dd', 'label', common_local_url('apioauthrequesttoken'));
         $this->elementEnd('dl');
 
         $this->elementStart('dl', 'entity_access_token_url');
         $this->element('dt', null, _('Access token URL'));
-        $this->element('dd', 'label', common_local_url('oauthaccesstoken'));
+        $this->element('dd', 'label', common_local_url('apioauthaccesstoken'));
         $this->elementEnd('dl');
 
         $this->elementStart('dl', 'entity_authorize_url');
         $this->element('dt', null, _('Authorize URL'));
-        $this->element('dd', 'label', common_local_url('oauthauthorize'));
+        $this->element('dd', 'label', common_local_url('apioauthauthorize'));
         $this->elementEnd('dl');
 
         $this->element('p', 'oauth-signature-note',
diff --git a/lib/router.php b/lib/router.php
index 0703d7597..420f5a0a1 100644
--- a/lib/router.php
+++ b/lib/router.php
@@ -50,7 +50,8 @@ class Router
     var $m = null;
     static $inst = null;
     static $bare = array('requesttoken', 'accesstoken', 'userauthorization',
-                         'postnotice', 'updateprofile', 'finishremotesubscribe');
+                         'postnotice', 'updateprofile', 'finishremotesubscribe',
+			 'apioauthrequesttoken', 'apioauthaccesstoken');
 
     static function get()
     {
@@ -144,7 +145,7 @@ class Router
                            'email', 'sms', 'userdesign', 'other') as $s) {
                 $m->connect('settings/'.$s, array('action' => $s.'settings'));
             }
-        
+
             // search
 
             foreach (array('group', 'people', 'notice') as $s) {
@@ -640,11 +641,11 @@ class Router
                             array('action' => $a),
                             array('nickname' => '[a-zA-Z0-9]{1,64}'));
             }
-            
-            $m->connect(':nickname/apps', 
+
+            $m->connect(':nickname/apps',
                 array('action' => 'apps'),
                 array('nickname' => '['.NICKNAME_FMT.']{1,64}'));
-            $m->connect(':nickname/apps/show/:id', 
+            $m->connect(':nickname/apps/show/:id',
                 array('action' => 'showapplication'),
                 array('nickname' => '['.NICKNAME_FMT.']{1,64}',
                       'id' => '[0-9]+')
@@ -652,18 +653,14 @@ class Router
             $m->connect(':nickname/apps/new',
                 array('action' => 'newapplication'),
                 array('nickname' => '['.NICKNAME_FMT.']{1,64}'));
-            $m->connect(':nickname/apps/edit/:id', 
+            $m->connect(':nickname/apps/edit/:id',
                 array('action' => 'editapplication'),
                 array('nickname' => '['.NICKNAME_FMT.']{1,64}',
                       'id' => '[0-9]+')
             );
 
-            $m->connect('oauth/request_token',
-                array('action' => 'apioauthrequesttoken'));
-            $m->connect('oauth/access_token',
-                array('action' => 'apioauthaccesstoken'));
             $m->connect('oauth/authorize',
-                array('action' => 'apioauthauthorize'));
+                        array('action' => 'apioauthauthorize'));
 
             foreach (array('subscriptions', 'subscribers') as $a) {
                 $m->connect(':nickname/'.$a.'/:tag',
-- 
cgit v1.2.3-54-g00ecf


From c473a39a7da07fbe5b80fec4c08111a554691c3a Mon Sep 17 00:00:00 2001
From: Zach Copley <zach@status.net>
Date: Sun, 10 Jan 2010 23:03:30 -0800
Subject: Associate request tokens with OAuth apps and app users

---
 actions/apioauthauthorize.php      | 64 +++++++++++++++++++++++++++++---------
 classes/Oauth_application_user.php | 24 +++++++++++++-
 classes/statusnet.ini              |  4 +++
 db/statusnet.sql                   |  5 ++-
 4 files changed, 81 insertions(+), 16 deletions(-)

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index 895a0c6e5..48d5087ef 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -125,19 +125,12 @@ class ApiOauthAuthorizeAction extends Action
         parent::handle($args);
 
         if ($_SERVER['REQUEST_METHOD'] == 'POST') {
-            /* Use a session token for CSRF protection. */
-            $token = $this->trimmed('token');
-            if (!$token || $token != common_session_token()) {
-                $this->showForm(_('There was a problem with your session token. '.
-                                  'Try again, please.'));
-                return;
-            }
 
             $this->handlePost();
 
         } else {
 
-            common_debug('ApiOauthAuthorize::handle()');
+	    // XXX: make better error messages
 
             if (empty($this->oauth_token)) {
 
@@ -160,7 +153,7 @@ class ApiOauthAuthorizeAction extends Action
 
     function handlePost()
     {
-        /* Use a session token for CSRF protection. */
+        // check session token for CSRF protection.
 
         $token = $this->trimmed('token');
 
@@ -175,25 +168,66 @@ class ApiOauthAuthorizeAction extends Action
             return;
         }
 
-        // is the user already logged in?
-
         // check creds
 
+	$user = null;
+
         if (!common_logged_in()) {
             $user = common_check_user($this->nickname, $this->password);
             if (empty($user)) {
                 $this->showForm(_("Invalid nickname / password!"));
                 return;
             }
-        }
+        } else {
+	    $user = common_current_user();
+	}
 
         if ($this->arg('allow')) {
 
+	    // mark the req token as authorized
+
             $this->store->authorize_token($this->oauth_token);
 
+	    // Check to see if there was a previous token associated
+	    // with this user/app and kill it. If you're doing this you
+	    // probably don't want any old tokens anyway.
+
+	    $appUser = Oauth_application_user::getByKeys($user, $this->app);
+
+	    if (!empty($appUser)) {
+		$result = $appUser->delete();
+
+		if (!$result) {
+		    common_log_db_error($appUser, 'DELETE', __FILE__);
+		    throw new ServerException(_('DB error deleting OAuth app user.'));
+		    return;
+		}
+	    }
+
+	    // associated the new req token with the user and the app
+
+	    $appUser = new Oauth_application_user();
+
+	    $appUser->profile_id     = $user->id;
+	    $appUser->application_id = $this->app->id;
+	    $appUser->access_type    = $this->app->access_type;
+	    $appUser->token          = $this->oauth_token;
+	    $appUser->created        = common_sql_now();
+
+	    $result = $appUser->insert();
+
+	    if (!$result) {
+		common_log_db_error($appUser, 'INSERT', __FILE__);
+		throw new ServerException(_('DB error inserting OAuth app user.'));
+		return;
+	    }
+
             // if we have a callback redirect and provide the token
 
             if (!empty($this->callback)) {
+
+		// XXX: Need better way to build this redirect url.
+
                 $target_url = $this->callback . '?oauth_token=' . $this->oauth_token;
                 common_redirect($target_url, 303);
             }
@@ -202,7 +236,7 @@ class ApiOauthAuthorizeAction extends Action
 
             $this->elementStart('p');
 
-            // XXX: Do verifier code?
+            // XXX: Do OAuth 1.0a verifier code?
 
             $this->raw(sprintf(_("The request token %s has been authorized. " .
                                  'Please exchange it for an access token.'),
@@ -233,7 +267,9 @@ class ApiOauthAuthorizeAction extends Action
     function showScripts()
     {
         parent::showScripts();
-      //  $this->autofocus('nickname');
+	if (!common_logged_in()) {
+	    $this->autofocus('nickname');
+	}
     }
 
     /**
diff --git a/classes/Oauth_application_user.php b/classes/Oauth_application_user.php
index 9e45ece25..e4c018f21 100644
--- a/classes/Oauth_application_user.php
+++ b/classes/Oauth_application_user.php
@@ -13,12 +13,34 @@ class Oauth_application_user extends Memcached_DataObject
     public $profile_id;                      // int(4)  primary_key not_null
     public $application_id;                  // int(4)  primary_key not_null
     public $access_type;                     // tinyint(1)
+    public $token;                           // varchar(255)
+    public $secret;                          // varchar(255)
+    public $verifier;                        // varchar(255)
     public $created;                         // datetime   not_null
+    public $modified;                        // timestamp   not_null default_CURRENT_TIMESTAMP
 
     /* Static get */
     function staticGet($k,$v=NULL) {
-	return Memcached_DataObject::staticGet('Oauth_application_user',$k,$v);
+        return Memcached_DataObject::staticGet('Oauth_application_user',$k,$v);
     }
     /* the code above is auto generated do not remove the tag below */
     ###END_AUTOCODE
+
+    static function getByKeys($user, $app)
+    {
+        if (empty($user) || empty($app)) {
+            return null;
+        }
+
+        $oau = new Oauth_application_user();
+
+        $oau->profile_id     = $user->id;
+	$oau->application_id = $app->id;
+        $oau->limit(1);
+
+        $result = $oau->find(true);
+
+        return empty($result) ? null : $oau;
+    }
+
 }
diff --git a/classes/statusnet.ini b/classes/statusnet.ini
index 0cbe60a5a..43f6c4466 100644
--- a/classes/statusnet.ini
+++ b/classes/statusnet.ini
@@ -372,7 +372,11 @@ id = N
 profile_id = 129
 application_id = 129
 access_type = 17
+token = 2
+secret = 2
+verifier = 2
 created = 142
+modified = 384
 
 [oauth_application_user__keys]
 profile_id = K
diff --git a/db/statusnet.sql b/db/statusnet.sql
index a2740b60c..eb4706067 100644
--- a/db/statusnet.sql
+++ b/db/statusnet.sql
@@ -229,8 +229,11 @@ create table oauth_application_user (
     profile_id integer not null comment 'user of the application' references profile (id),
     application_id integer not null comment 'id of the application' references oauth_application (id),
     access_type tinyint default 0 comment 'access type, bit 1 = read, bit 2 = write, bit 3 = revoked',
+    token varchar(255) comment 'authorization token',
+    secret varchar(255) comment 'token secret',
+    verifier varchar(255) not null comment 'verification code',
     created datetime not null comment 'date this record was created',
-
+    modified timestamp comment 'date this record was modified',
     constraint primary key (profile_id, application_id)
 ) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin;
 
-- 
cgit v1.2.3-54-g00ecf


From 8da5e98cba12c32f0b75a90d1ff0007b73f0fc8d Mon Sep 17 00:00:00 2001
From: Zach Copley <zach@status.net>
Date: Wed, 13 Jan 2010 05:06:35 +0000
Subject: OAuth 1.0 working now

---
 actions/apioauthaccesstoken.php  |  40 +++++-------
 actions/apioauthauthorize.php    | 111 +++++++++++++++++++------------
 actions/apioauthrequesttoken.php |  24 +++++--
 lib/apiauth.php                  | 138 +++++++++++++++++----------------------
 lib/apioauth.php                 | 122 ++++++++++++++++++++++++++++++++++
 lib/apioauthstore.php            |  69 +++++++++++---------
 lib/router.php                   |  11 +++-
 7 files changed, 330 insertions(+), 185 deletions(-)
 create mode 100644 lib/apioauth.php

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthaccesstoken.php b/actions/apioauthaccesstoken.php
index 67359d765..085ef6f0b 100644
--- a/actions/apioauthaccesstoken.php
+++ b/actions/apioauthaccesstoken.php
@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Exchange an authorized OAuth request token for an access token
@@ -43,19 +43,9 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
  * @link     http://status.net/
  */
 
-class ApiOauthAccessTokenAction extends Action
+class ApiOauthAccessTokenAction extends ApiOauthAction
 {
 
-    /**
-     * Is read only?
-     *
-     * @return boolean false
-     */
-    function isReadOnly()
-    {
-        return false;
-    }
-
     /**
      * Class handler.
      *
@@ -73,7 +63,7 @@ class ApiOauthAccessTokenAction extends Action
 
         $server->add_signature_method($hmac_method);
 
-	$atok = null;
+        $atok = null;
 
         try {
             $req  = OAuthRequest::from_request();
@@ -81,24 +71,24 @@ class ApiOauthAccessTokenAction extends Action
 
         } catch (OAuthException $e) {
             common_log(LOG_WARN, 'API OAuthException - ' . $e->getMessage());
-	    common_debug(var_export($req, true));
-	    $this->outputError($e->getMessage());
-	    return;
+            common_debug(var_export($req, true));
+            $this->outputError($e->getMessage());
+            return;
         }
 
-	if (empty($atok)) {
-	    common_debug('couldn\'t get access token.');
-	    print "Token exchange failed. Has the request token been authorized?\n";
-	} else {
-	    print $atok;
-	}
+        if (empty($atok)) {
+            common_debug('couldn\'t get access token.');
+            print "Token exchange failed. Has the request token been authorized?\n";
+        } else {
+            print $atok;
+        }
     }
 
     function outputError($msg)
     {
-	header('HTTP/1.1 401 Unauthorized');
-	header('Content-Type: text/html; charset=utf-8');
-	print $msg . "\n";
+        header('HTTP/1.1 401 Unauthorized');
+        header('Content-Type: text/html; charset=utf-8');
+        print $msg . "\n";
     }
 }
 
diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index 48d5087ef..cdf9cb7df 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Authorize an OAuth request token
@@ -43,7 +43,7 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
  * @link     http://status.net/
  */
 
-class ApiOauthAuthorizeAction extends Action
+class ApiOauthAuthorizeAction extends ApiOauthAction
 {
     var $oauth_token;
     var $callback;
@@ -67,7 +67,7 @@ class ApiOauthAuthorizeAction extends Action
     {
         parent::prepare($args);
 
-        common_debug(var_export($_REQUEST, true));
+        common_debug("apioauthauthorize");
 
         $this->nickname    = $this->trimmed('nickname');
         $this->password    = $this->arg('password');
@@ -130,7 +130,7 @@ class ApiOauthAuthorizeAction extends Action
 
         } else {
 
-	    // XXX: make better error messages
+            // XXX: make better error messages
 
             if (empty($this->oauth_token)) {
 
@@ -145,7 +145,8 @@ class ApiOauthAuthorizeAction extends Action
                 return;
             }
 
-            common_debug("Requesting auth for app: $app->name.");
+            $name = $this->app->name;
+            common_debug("Requesting auth for app: " . $name);
 
             $this->showForm();
         }
@@ -153,6 +154,8 @@ class ApiOauthAuthorizeAction extends Action
 
     function handlePost()
     {
+        common_debug("handlePost()");
+
         // check session token for CSRF protection.
 
         $token = $this->trimmed('token');
@@ -170,7 +173,7 @@ class ApiOauthAuthorizeAction extends Action
 
         // check creds
 
-	$user = null;
+        $user = null;
 
         if (!common_logged_in()) {
             $user = common_check_user($this->nickname, $this->password);
@@ -179,64 +182,86 @@ class ApiOauthAuthorizeAction extends Action
                 return;
             }
         } else {
-	    $user = common_current_user();
-	}
+            $user = common_current_user();
+        }
 
         if ($this->arg('allow')) {
 
-	    // mark the req token as authorized
+            // mark the req token as authorized
 
             $this->store->authorize_token($this->oauth_token);
 
-	    // Check to see if there was a previous token associated
-	    // with this user/app and kill it. If you're doing this you
-	    // probably don't want any old tokens anyway.
+            // Check to see if there was a previous token associated
+            // with this user/app and kill it. If the user is doing this she
+            // probably doesn't want any old tokens anyway.
+
+            $appUser = Oauth_application_user::getByKeys($user, $this->app);
+
+            if (!empty($appUser)) {
+                $result = $appUser->delete();
 
-	    $appUser = Oauth_application_user::getByKeys($user, $this->app);
+                if (!$result) {
+                    common_log_db_error($appUser, 'DELETE', __FILE__);
+                    throw new ServerException(_('DB error deleting OAuth app user.'));
+                    return;
+                }
+            }
 
-	    if (!empty($appUser)) {
-		$result = $appUser->delete();
+            // associated the authorized req token with the user and the app
 
-		if (!$result) {
-		    common_log_db_error($appUser, 'DELETE', __FILE__);
-		    throw new ServerException(_('DB error deleting OAuth app user.'));
-		    return;
-		}
-	    }
+            $appUser = new Oauth_application_user();
 
-	    // associated the new req token with the user and the app
+            $appUser->profile_id     = $user->id;
+            $appUser->application_id = $this->app->id;
 
-	    $appUser = new Oauth_application_user();
+            // Note: do not copy the access type from the application.
+            // The access type should always be 0 when the OAuth app
+            // user record has a request token associated with it.
+            // Access type gets assigned once an access token has been
+            // granted.  The OAuth app user record then gets updated
+            // with the new access token and access type.
 
-	    $appUser->profile_id     = $user->id;
-	    $appUser->application_id = $this->app->id;
-	    $appUser->access_type    = $this->app->access_type;
-	    $appUser->token          = $this->oauth_token;
-	    $appUser->created        = common_sql_now();
+            $appUser->token          = $this->oauth_token;
+            $appUser->created        = common_sql_now();
 
-	    $result = $appUser->insert();
+            $result = $appUser->insert();
 
-	    if (!$result) {
-		common_log_db_error($appUser, 'INSERT', __FILE__);
-		throw new ServerException(_('DB error inserting OAuth app user.'));
-		return;
-	    }
+            if (!$result) {
+                common_log_db_error($appUser, 'INSERT', __FILE__);
+                throw new ServerException(_('DB error inserting OAuth app user.'));
+                return;
+            }
 
             // if we have a callback redirect and provide the token
 
+            // A callback specified in the app setup overrides whatever
+            // is passed in with the request.
+
+            common_debug("Req token is authorized - doing callback");
+
+            if (!empty($this->app->callback_url)) {
+                $this->callback = $this->app->callback_url;
+            }
+
             if (!empty($this->callback)) {
 
-		// XXX: Need better way to build this redirect url.
+                // XXX: Need better way to build this redirect url.
+
+                $target_url = $this->getCallback($this->callback,
+                                                 array('oauth_token' => $this->oauth_token));
+
+                common_debug("Doing callback to $target_url");
 
-                $target_url = $this->callback . '?oauth_token=' . $this->oauth_token;
                 common_redirect($target_url, 303);
+            } else {
+                common_debug("callback was empty!");
             }
 
             // otherwise inform the user that the rt was authorized
 
             $this->elementStart('p');
 
-            // XXX: Do OAuth 1.0a verifier code?
+            // XXX: Do OAuth 1.0a verifier code
 
             $this->raw(sprintf(_("The request token %s has been authorized. " .
                                  'Please exchange it for an access token.'),
@@ -267,9 +292,9 @@ class ApiOauthAuthorizeAction extends Action
     function showScripts()
     {
         parent::showScripts();
-	if (!common_logged_in()) {
-	    $this->autofocus('nickname');
-	}
+        if (!common_logged_in()) {
+            $this->autofocus('nickname');
+        }
     }
 
     /**
@@ -313,9 +338,9 @@ class ApiOauthAuthorizeAction extends Action
     function showContent()
     {
         $this->elementStart('form', array('method' => 'post',
-                                           'id' => 'form_login',
-                                           'class' => 'form_settings',
-                                           'action' => common_local_url('apioauthauthorize')));
+                                          'id' => 'form_login',
+                                          'class' => 'form_settings',
+                                          'action' => common_local_url('apioauthauthorize')));
 
         $this->hidden('token', common_session_token());
         $this->hidden('oauth_token', $this->oauth_token);
diff --git a/actions/apioauthrequesttoken.php b/actions/apioauthrequesttoken.php
index 53aca6b96..467640b9a 100644
--- a/actions/apioauthrequesttoken.php
+++ b/actions/apioauthrequesttoken.php
@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Get an OAuth request token
@@ -43,16 +43,28 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
  * @link     http://status.net/
  */
 
-class ApiOauthRequestTokenAction extends Action
+class ApiOauthRequestTokenAction extends ApiOauthAction
 {
     /**
-     * Is read only?
+     * Take arguments for running
+     *
+     * @param array $args $_REQUEST args
+     *
+     * @return boolean success flag
      *
-     * @return boolean false
      */
-    function isReadOnly()
+
+    function prepare($args)
     {
-        return false;
+        parent::prepare($args);
+
+        $this->callback  = $this->arg('oauth_callback');
+
+        if (!empty($this->callback)) {
+            common_debug("callback: $this->callback");
+        }
+
+        return true;
     }
 
     /**
diff --git a/lib/apiauth.php b/lib/apiauth.php
index 3229ab19f..431f3ac4f 100644
--- a/lib/apiauth.php
+++ b/lib/apiauth.php
@@ -39,7 +39,7 @@ if (!defined('STATUSNET')) {
 }
 
 require_once INSTALLDIR . '/lib/api.php';
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
  * Actions extending this class will require auth
@@ -71,14 +71,14 @@ class ApiAuthAction extends ApiAction
 
         if ($this->requiresAuth()) {
 
-	    $this->consumer_key = $this->arg('oauth_consumer_key');
-	    $this->access_token = $this->arg('oauth_token');
+            $this->consumer_key = $this->arg('oauth_consumer_key');
+            $this->access_token = $this->arg('oauth_token');
 
-	    if (!empty($this->access_token)) {
-		$this->checkOAuthRequest();
-	    } else {
-		$this->checkBasicAuthUser();
-	    }
+            if (!empty($this->access_token)) {
+                $this->checkOAuthRequest();
+            } else {
+                $this->checkBasicAuthUser();
+            }
         }
 
         return true;
@@ -86,101 +86,83 @@ class ApiAuthAction extends ApiAction
 
     function checkOAuthRequest()
     {
-	common_debug("We have an OAuth request.");
+        common_debug("We have an OAuth request.");
 
-	$datastore   = new ApiStatusNetOAuthDataStore();
-	$server      = new OAuthServer($datastore);
-	$hmac_method = new OAuthSignatureMethod_HMAC_SHA1();
+        $datastore   = new ApiStatusNetOAuthDataStore();
+        $server      = new OAuthServer($datastore);
+        $hmac_method = new OAuthSignatureMethod_HMAC_SHA1();
 
-	$server->add_signature_method($hmac_method);
+        $server->add_signature_method($hmac_method);
 
-	$this->cleanRequest();
+        ApiOauthAction::cleanRequest();
 
-	try {
+        try {
 
-	    $req  = OAuthRequest::from_request();
-	    $server->verify_request($req);
+            $req  = OAuthRequest::from_request();
+            $server->verify_request($req);
 
-	    common_debug("Good OAuth request!");
+            common_debug("Good OAuth request!");
 
-	    $app = Oauth_application::getByConsumerKey($this->consumer_key);
+            $app = Oauth_application::getByConsumerKey($this->consumer_key);
 
-	    if (empty($app)) {
+            if (empty($app)) {
 
-		// this should really not happen
-		common_log(LOG_WARN,
-			   "Couldn't find the OAuth app for consumer key: $this->consumer_key");
+                // this should really not happen
+                common_log(LOG_WARN,
+                           "Couldn't find the OAuth app for consumer key: $this->consumer_key");
 
-		throw new OAuthException('No application for that consumer key.');
-	    }
+                throw new OAuthException('No application for that consumer key.');
+            }
 
-	    $appUser = Oauth_application_user::staticGet('token',
-							 $this->access_token);
+            $appUser = Oauth_application_user::staticGet('token',
+                                                         $this->access_token);
 
-	    // XXX: check that app->id and appUser->application_id and consumer all
-	    // match?
+            // XXX: check that app->id and appUser->application_id and consumer all
+            // match?
 
-	    if (!empty($appUser)) {
+            if (!empty($appUser)) {
 
-		// read or read-write
-		$this->oauth_access_type = $appUser->access_type;
+                // read or read-write
+                $this->oauth_access_type = $appUser->access_type;
 
-		// If access_type == 0 we have either a request token
-		// or a bad / revoked access token
+                // If access_type == 0 we have either a request token
+                // or a bad / revoked access token
 
-		if ($this->oauth_access_type != 0) {
+                if ($this->oauth_access_type != 0) {
 
-		    $this->auth_user = User::staticGet('id', $appUser->profile_id);
+                    $this->auth_user = User::staticGet('id', $appUser->profile_id);
 
-		    $msg = "API OAuth authentication for user '%s' (id: %d) on behalf of " .
-		      "application '%s' (id: %d).";
+                    $msg = "API OAuth authentication for user '%s' (id: %d) on behalf of " .
+                      "application '%s' (id: %d).";
 
-		    common_log(LOG_INFO, sprintf($msg,
-						 $this->auth_user->nickname,
-						 $this->auth_user->id,
-						 $app->name,
-						 $app->id));
-		    return true;
-		} else {
-		    throw new OAuthException('Bad access token.');
-		}
-	    } else {
+                    common_log(LOG_INFO, sprintf($msg,
+                                                 $this->auth_user->nickname,
+                                                 $this->auth_user->id,
+                                                 $app->name,
+                                                 $app->id));
+                    return true;
+                } else {
+                    throw new OAuthException('Bad access token.');
+                }
+            } else {
 
-		// also should not happen
-		throw new OAuthException('No user for that token.');
-	    }
+                // also should not happen
+                throw new OAuthException('No user for that token.');
+        }
 
-	} catch (OAuthException $e) {
-	    common_log(LOG_WARN, 'API OAuthException - ' . $e->getMessage());
-	    common_debug(var_export($req, true));
-	    $this->showOAuthError($e->getMessage());
-	    exit();
-	}
+        } catch (OAuthException $e) {
+            common_log(LOG_WARN, 'API OAuthException - ' . $e->getMessage());
+            common_debug(var_export($req, true));
+            $this->showOAuthError($e->getMessage());
+            exit();
+        }
     }
 
     function showOAuthError($msg)
     {
-	header('HTTP/1.1 401 Unauthorized');
-	header('Content-Type: text/html; charset=utf-8');
-	print $msg . "\n";
-    }
-
-    function cleanRequest()
-    {
-	// kill evil effects of magical slashing
-
-	if(get_magic_quotes_gpc() == 1) {
-	    $_POST = array_map('stripslashes', $_POST);
-	    $_GET = array_map('stripslashes', $_GET);
-	}
-
-	// strip out the p param added in index.php
-
-	// XXX: should we strip anything else?  Or alternatively
-	// only allow a known list of params?
-
-	unset($_GET['p']);
-	unset($_POST['p']);
+        header('HTTP/1.1 401 Unauthorized');
+        header('Content-Type: text/html; charset=utf-8');
+        print $msg . "\n";
     }
 
     /**
diff --git a/lib/apioauth.php b/lib/apioauth.php
new file mode 100644
index 000000000..4cb8a6775
--- /dev/null
+++ b/lib/apioauth.php
@@ -0,0 +1,122 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Base action for OAuth API endpoints
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  API
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+require_once INSTALLDIR . '/lib/apioauthstore.php';
+
+/**
+ * Base action for API OAuth enpoints.  Clean up the
+ * the request, and possibly some other common things
+ * here.
+ *
+ * @category API
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class ApiOauthAction extends Action
+{
+    /**
+     * Is this a read-only action?
+     *
+     * @return boolean false
+     */
+
+    function isReadOnly($args)
+    {
+        return false;
+    }
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+        return true;
+    }
+
+    /**
+     * Handle input, produce output
+     *
+     * Switches on request method; either shows the form or handles its input.
+     *
+     * @param array $args $_REQUEST data
+     *
+     * @return void
+     */
+
+    function handle($args)
+    {
+        parent::handle($args);
+        self::cleanRequest();
+    }
+
+    static function cleanRequest()
+    {
+        // kill evil effects of magical slashing
+
+        if (get_magic_quotes_gpc() == 1) {
+            $_POST = array_map('stripslashes', $_POST);
+            $_GET = array_map('stripslashes', $_GET);
+        }
+
+        // strip out the p param added in index.php
+
+        // XXX: should we strip anything else?  Or alternatively
+        // only allow a known list of params?
+
+        unset($_GET['p']);
+        unset($_POST['p']);
+    }
+
+    function getCallback($url, $params)
+    {
+        foreach ($params as $k => $v) {
+            $url = $this->appendQueryVar($url,
+                                         OAuthUtil::urlencode_rfc3986($k),
+                                         OAuthUtil::urlencode_rfc3986($v));
+        }
+
+        return $url;
+    }
+
+    function appendQueryVar($url, $k, $v) {
+        $url = preg_replace('/(.*)(\?|&)' . $k . '=[^&]+?(&)(.*)/i', '$1$2$4', $url . '&');
+        $url = substr($url, 0, -1);
+        if (strpos($url, '?') === false) {
+            return ($url . '?' . $k . '=' . $v);
+        } else {
+            return ($url . '&' . $k . '=' . $v);
+        }
+    }
+
+}
diff --git a/lib/apioauthstore.php b/lib/apioauthstore.php
index 290ce8973..c39ddbb0f 100644
--- a/lib/apioauthstore.php
+++ b/lib/apioauthstore.php
@@ -40,44 +40,44 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
     {
         common_debug('new_access_token("'.$token->key.'","'.$consumer->key.'")', __FILE__);
 
-	$rt = new Token();
+        $rt = new Token();
         $rt->consumer_key = $consumer->key;
         $rt->tok = $token->key;
         $rt->type = 0; // request
 
         $app = Oauth_application::getByConsumerKey($consumer->key);
 
-	if (empty($app)) {
-	    common_debug("empty app!");
-	}
+        if (empty($app)) {
+            common_debug("empty app!");
+        }
 
-	if ($rt->find(true) && $rt->state == 1) { // authorized
+        if ($rt->find(true) && $rt->state == 1) { // authorized
             common_debug('request token found.', __FILE__);
 
-	    // find the associated user of the app
+            // find the associated user of the app
 
-	    $appUser = new Oauth_application_user();
-	    $appUser->application_id = $app->id;
-	    $appUser->token = $rt->tok;
-	    $result = $appUser->find(true);
+            $appUser = new Oauth_application_user();
+            $appUser->application_id = $app->id;
+            $appUser->token = $rt->tok;
+            $result = $appUser->find(true);
 
-	    if (!empty($result)) {
-		common_debug("Oath app user found.");
-	    } else {
-		common_debug("Oauth app user not found.");
-		return null;
-	    }
+            if (!empty($result)) {
+                common_debug("Oath app user found.");
+            } else {
+                common_debug("Oauth app user not found.");
+                return null;
+            }
 
-	    // go ahead and make the access token
+            // go ahead and make the access token
 
-	    $at = new Token();
+            $at = new Token();
             $at->consumer_key = $consumer->key;
             $at->tok = common_good_rand(16);
             $at->secret = common_good_rand(16);
             $at->type = 1; // access
             $at->created = DB_DataObject_Cast::dateTime();
 
-	    if (!$at->insert()) {
+            if (!$at->insert()) {
                 $e = $at->_lastError;
                 common_debug('access token "'.$at->tok.'" not inserted: "'.$e->message.'"', __FILE__);
                 return null;
@@ -91,21 +91,30 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
                 }
                 common_debug('request token "'.$rt->tok.'" updated', __FILE__);
 
-		// update the token from req to access for the user
+                // update the token from req to access for the user
+
+                $orig = clone($appUser);
+                $appUser->token = $at->tok;
 
-	        $orig = clone($appUser);
-		$appUser->token = $at->tok;
-		$result = $appUser->update($orig);
+                // It's at this point that we change the access type
+                // to whatever the application's access is.  Request
+                // tokens should always have an access type of 0, and
+                // therefore be unuseable for making requests for
+                // protected resources.
 
-		if (empty($result)) {
-		    common_debug('couldn\'t update OAuth app user.');
-		    return null;
-		}
+                $appUser->access_type = $app->access_type;
+
+                $result = $appUser->update($orig);
+
+                if (empty($result)) {
+                    common_debug('couldn\'t update OAuth app user.');
+                    return null;
+                }
 
-		// Okay, good
+                // Okay, good
 
-		return new OAuthToken($at->tok, $at->secret);
-	    }
+                return new OAuthToken($at->tok, $at->secret);
+            }
 
         } else {
             return null;
diff --git a/lib/router.php b/lib/router.php
index 420f5a0a1..d6e448c2f 100644
--- a/lib/router.php
+++ b/lib/router.php
@@ -50,8 +50,7 @@ class Router
     var $m = null;
     static $inst = null;
     static $bare = array('requesttoken', 'accesstoken', 'userauthorization',
-                         'postnotice', 'updateprofile', 'finishremotesubscribe',
-			 'apioauthrequesttoken', 'apioauthaccesstoken');
+                         'postnotice', 'updateprofile', 'finishremotesubscribe');
 
     static function get()
     {
@@ -659,7 +658,13 @@ class Router
                       'id' => '[0-9]+')
             );
 
-            $m->connect('oauth/authorize',
+            $m->connect('api/oauth/request_token',
+                        array('action' => 'apioauthrequesttoken'));
+
+            $m->connect('api/oauth/access_token',
+                        array('action' => 'apioauthaccesstoken'));
+
+            $m->connect('api/oauth/authorize',
                         array('action' => 'apioauthauthorize'));
 
             foreach (array('subscriptions', 'subscribers') as $a) {
-- 
cgit v1.2.3-54-g00ecf


From c0eee277d1058c9c291b3c4474cc8a72cb8c6d0e Mon Sep 17 00:00:00 2001
From: Zach Copley <zach@status.net>
Date: Wed, 13 Jan 2010 11:31:15 +0000
Subject: Make sure applications are really looked up by consumer key

---
 actions/apioauthauthorize.php | 42 +++---------------------------------------
 lib/apioauthstore.php         | 40 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 42 insertions(+), 40 deletions(-)

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index cdf9cb7df..0966ba1d7 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -74,42 +74,11 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         $this->oauth_token = $this->arg('oauth_token');
         $this->callback    = $this->arg('oauth_callback');
         $this->store       = new ApiStatusNetOAuthDataStore();
+        $this->app         = $this->store->getAppByRequestToken($this->oauth_token);
 
         return true;
     }
 
-    function getApp()
-    {
-        // Look up the full req token
-
-        $req_token = $this->store->lookup_token(null,
-                                                'request',
-                                                $this->oauth_token);
-
-        if (empty($req_token)) {
-
-            common_debug("Couldn't find request token!");
-
-            $this->clientError(_('Bad request.'));
-            return;
-        }
-
-        // Look up the app
-
-        $app = new Oauth_application();
-        $app->consumer_key = $req_token->consumer_key;
-        $result = $app->find(true);
-
-        if (!empty($result)) {
-            $this->app = $app;
-            return true;
-
-        } else {
-            common_debug("couldn't find the app!");
-            return false;
-        }
-    }
-
     /**
      * Handle input, produce output
      *
@@ -140,7 +109,8 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
                 return;
             }
 
-            if (!$this->getApp()) {
+            if (empty($this->app)) {
+                common_debug('No app for that token.');
                 $this->clientError(_('Bad request.'));
                 return;
             }
@@ -166,11 +136,6 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
             return;
         }
 
-        if (!$this->getApp()) {
-            $this->clientError(_('Bad request.'));
-            return;
-        }
-
         // check creds
 
         $user = null;
@@ -416,7 +381,6 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
     function getInstructions()
     {
         return _('Allow or deny access to your account information.');
-
     }
 
     /**
diff --git a/lib/apioauthstore.php b/lib/apioauthstore.php
index c39ddbb0f..32110d057 100644
--- a/lib/apioauthstore.php
+++ b/lib/apioauthstore.php
@@ -36,6 +36,44 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
                                  $con->consumer_secret);
     }
 
+    function getAppByRequestToken($token_key)
+    {
+        // Look up the full req tokenx
+
+        $req_token = $this->lookup_token(null,
+                                         'request',
+                                         $token_key);
+
+        if (empty($req_token)) {
+            common_debug("couldn't get request token from oauth datastore");
+            return null;
+        }
+
+        // Look up the full Token
+
+        $token = new Token();
+        $token->tok = $req_token->key;
+        $result = $token->find(true);
+
+        if (empty($result)) {
+            common_debug('Couldn\'t find req token in the token table.');
+            return null;
+        }
+
+        // Look up the app
+
+        $app = new Oauth_application();
+        $app->consumer_key = $token->consumer_key;
+        $result = $app->find(true);
+
+        if (!empty($result)) {
+            return $app;
+        } else {
+            common_debug("Couldn't find the app!");
+            return null;
+        }
+    }
+
     function new_access_token($token, $consumer)
     {
         common_debug('new_access_token("'.$token->key.'","'.$consumer->key.'")', __FILE__);
@@ -64,7 +102,7 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
             if (!empty($result)) {
                 common_debug("Oath app user found.");
             } else {
-                common_debug("Oauth app user not found.");
+                common_debug("Oauth app user not found. app id $app->id token $rt->tok");
                 return null;
             }
 
-- 
cgit v1.2.3-54-g00ecf


From 6d58ef4abb12d735b6be777ea79f99a07c68694a Mon Sep 17 00:00:00 2001
From: Sarven Capadisli <csarven@status.net>
Date: Wed, 13 Jan 2010 20:10:09 +0000
Subject: Updated apioauthauthorize markup and styles

---
 actions/apioauthauthorize.php | 46 +++++++++++--------------------------------
 theme/base/css/display.css    | 10 ++++++++--
 2 files changed, 20 insertions(+), 36 deletions(-)

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index 0966ba1d7..72d142651 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -273,27 +273,6 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         return _('An application would like to connect to your account');
     }
 
-    /**
-     * Show page notice
-     *
-     * Display a notice for how to use the page, or the
-     * error if it exists.
-     *
-     * @return void
-     */
-
-    function showPageNotice()
-    {
-        if ($this->error) {
-            $this->element('p', 'error', $this->error);
-        } else {
-            $instr  = $this->getInstructions();
-            $output = common_markup_to_html($instr);
-
-            $this->raw($output);
-        }
-    }
-
     /**
      * Shows the authorization form.
      *
@@ -303,40 +282,38 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
     function showContent()
     {
         $this->elementStart('form', array('method' => 'post',
-                                          'id' => 'form_login',
+                                          'id' => 'form_apioauthauthorize',
                                           'class' => 'form_settings',
                                           'action' => common_local_url('apioauthauthorize')));
+        $this->elementStart('fieldset');
+        $this->element('legend', array('id' => 'apioauthauthorize_allowdeny'),
+                                 _('Allow or deny access'));
 
         $this->hidden('token', common_session_token());
         $this->hidden('oauth_token', $this->oauth_token);
         $this->hidden('oauth_callback', $this->callback);
 
-        $this->elementStart('fieldset');
-
-        $this->elementStart('ul');
+        $this->elementStart('ul', 'form_data');
         $this->elementStart('li');
+        $this->elementStart('p');
         if (!empty($this->app->icon)) {
             $this->element('img', array('src' => $this->app->icon));
         }
-        $this->elementEnd('li');
-        $this->elementStart('li');
 
         $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
           'access and update' : 'access';
 
-        $msg = _("The application <b>%s</b> by <b>%s</b> would like " .
-                 "the ability to <b>%s</b> your account data.");
+        $msg = _("The application <strong>%s</strong> by <strong>%s</strong> would like " .
+                 "the ability to <strong>%s</strong> your account data.");
 
         $this->raw(sprintf($msg,
                            $this->app->name,
                            $this->app->organization,
                            $access));
-
+        $this->elementEnd('p');
         $this->elementEnd('li');
         $this->elementEnd('ul');
 
-        $this->elementEnd('fieldset');
-
         if (!common_logged_in()) {
 
             $this->elementStart('fieldset');
@@ -355,17 +332,18 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         }
 
         $this->element('input', array('id' => 'deny_submit',
-                                      'class' => 'submit',
+                                      'class' => 'submit submit form_action-primary',
                                       'name' => 'deny',
                                       'type' => 'submit',
                                       'value' => _('Deny')));
 
         $this->element('input', array('id' => 'allow_submit',
-                                      'class' => 'submit',
+                                      'class' => 'submit submit form_action-secondary',
                                       'name' => 'allow',
                                       'type' => 'submit',
                                       'value' => _('Allow')));
 
+        $this->elementEnd('fieldset');
         $this->elementEnd('form');
     }
 
diff --git a/theme/base/css/display.css b/theme/base/css/display.css
index 82670c964..ff81d3727 100644
--- a/theme/base/css/display.css
+++ b/theme/base/css/display.css
@@ -177,7 +177,8 @@ font-weight:bold;
 #form_password_recover legend,
 #form_password_change legend,
 .form_entity_block legend,
-#form_filter_bytag legend {
+#form_filter_bytag legend,
+#apioauthauthorize_allowdeny {
 display:none;
 }
 
@@ -906,10 +907,15 @@ list-style-type:none;
 }
 .application img,
 #showapplication .entity_profile img,
-#editapplication .form_data #application_icon img {
+#editapplication .form_data #application_icon,
+#apioauthauthorize .form_data img {
 max-width:96px;
 max-height:96px;
 }
+#apioauthauthorize .form_data img {
+margin-right:18px;
+float:left;
+}
 #showapplication .entity_profile {
 width:68%;
 }
-- 
cgit v1.2.3-54-g00ecf


From dbcbc2fe7ff0368910a49ed5675b0edc1e2bf18d Mon Sep 17 00:00:00 2001
From: Sarven Capadisli <csarven@status.net>
Date: Wed, 13 Jan 2010 20:43:23 +0000
Subject: Changed legend text from Login to Account because it is not really
 logging iny

---
 actions/apioauthauthorize.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index 72d142651..fa074c4e7 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -317,7 +317,7 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         if (!common_logged_in()) {
 
             $this->elementStart('fieldset');
-            $this->element('legend', null, _('Login'));
+            $this->element('legend', null, _('Account'));
             $this->elementStart('ul', 'form_data');
             $this->elementStart('li');
             $this->input('nickname', _('Nickname'));
-- 
cgit v1.2.3-54-g00ecf


From 5182cc686dacfcf64130b591a3b7ded8d4a0c9dc Mon Sep 17 00:00:00 2001
From: Zach Copley <zach@status.net>
Date: Thu, 28 Jan 2010 01:39:18 +0000
Subject: Numbered format specifiers

---
 actions/apioauthauthorize.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'actions/apioauthauthorize.php')

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index fa074c4e7..15c3a9dad 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -303,8 +303,9 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
           'access and update' : 'access';
 
-        $msg = _("The application <strong>%s</strong> by <strong>%s</strong> would like " .
-                 "the ability to <strong>%s</strong> your account data.");
+        $msg = _('The application <strong>%1$s</strong> by ' .
+                 '<strong>%2$s</strong> would like the ability ' .
+                 'to <strong>%3$s</strong> your account data.');
 
         $this->raw(sprintf($msg,
                            $this->app->name,
-- 
cgit v1.2.3-54-g00ecf