Merge branch '0.9.x' into pluginize-twitter-bridge

* 0.9.x: (247 commits)
  Added in credits.
  Use site's name for basic auth realm
  Make apigroupcreate.php pass phpcs
  Took out some unnecessary intializations
  Implemented create group api
  CamelCase all function names in the API code
  These same params are used in most API actions; moved to base API class
  Missed some of the references to the old TwitterApiAction - removed
  Remove more redundant $formats
  Remove dead code
  Move all basic auth output and processing to base classes
  $format is used by every API action. Set it in the base class.
  Delete action/api.php and rename lib/twitterapi.php to lib/api.php
  New actions for blocks via API
  fix FBConnect so it doesn't muffle EndPrimaryNav
  don't write session if it's unchanged
  Fixed facebook connect primary nav to hide search option when site is private and user is not logged in
  Fixed facebook connect primary nav to obey sms/twitter/openid settings
  Fixed facebook connect login nav to obey openid settings
  Fixed facebook connect nav to obey sms/twitter disabled
  ...

1 files changed, 203 insertions, 0 deletions

diff --git a/lib/apiauth.php b/lib/apiauth.php
new file mode 100644
index 000000000..2f2e44a26
--- /dev/null
+++ b/lib/apiauth.php
@@ -0,0 +1,203 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Base class for API actions that require authentication
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  API
+ * @package   StatusNet
+ * @author    Adrian Lang <mail@adrianlang.de>
+ * @author    Brenda Wallace <shiny@cpan.org>
+ * @author    Craig Andrews <candrews@integralblue.com>
+ * @author    Dan Moore <dan@moore.cx>
+ * @author    Evan Prodromou <evan@status.net>
+ * @author    mEDI <medi@milaro.net>
+ * @author    Sarven Capadisli <csarven@status.net>
+ * @author    Zach Copley <zach@status.net> 
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+require_once INSTALLDIR . '/lib/api.php';
+
+/**
+ * Actions extending this class will require auth
+ *
+ * @category API
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class ApiAuthAction extends ApiAction
+{
+
+    var $auth_user = null;
+
+    /**
+     * Take arguments for running, and output basic auth header if needed
+     *
+     * @param array $args $_REQUEST args
+     *
+     * @return boolean success flag
+     *
+     */
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+
+        if ($this->requiresAuth()) {
+            $this->checkBasicAuthUser();
+        }
+
+        return true;
+    }
+
+    /**
+     * Does this API resource require authentication?
+     *
+     * @return boolean true
+     */
+
+    function requiresAuth()
+    {
+        return true;
+    }
+
+    /**
+     * Check for a user specified via HTTP basic auth. If there isn't
+     * one, try to get one by outputting the basic auth header.
+     *
+     * @return boolean true or false
+     */
+
+    function checkBasicAuthUser()
+    {
+        $this->basicAuthProcessHeader();
+
+        $realm = common_config('site', 'name') . ' API';
+
+        if (!isset($this->auth_user)) {
+            header('WWW-Authenticate: Basic realm="' . $realm . '"');
+
+            // show error if the user clicks 'cancel'
+
+            $this->showBasicAuthError();
+            exit;
+
+        } else {
+            $nickname = $this->auth_user;
+            $password = $this->auth_pw;
+            $this->auth_user = common_check_user($nickname, $password);
+
+            if (empty($this->auth_user)) {
+
+                // basic authentication failed
+
+                list($proxy, $ip) = common_client_ip();
+                common_log(
+                    LOG_WARNING,
+                    'Failed API auth attempt, nickname = ' .
+                    "$nickname, proxy = $proxy, ip = $ip."
+                );
+                $this->showBasicAuthError();
+                exit;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Read the HTTP headers and set the auth user.  Decodes HTTP_AUTHORIZATION
+     * param to support basic auth when PHP is running in CGI mode.
+     *
+     * @return void
+     */
+
+    function basicAuthProcessHeader()
+    {
+        if (isset($_SERVER['AUTHORIZATION'])
+            || isset($_SERVER['HTTP_AUTHORIZATION'])
+        ) {
+                $authorization_header = isset($_SERVER['HTTP_AUTHORIZATION'])
+                ? $_SERVER['HTTP_AUTHORIZATION'] : $_SERVER['AUTHORIZATION'];
+        }
+
+        if (isset($_SERVER['PHP_AUTH_USER'])) {
+            $this->auth_user = $_SERVER['PHP_AUTH_USER'];
+            $this->auth_pw = $_SERVER['PHP_AUTH_PW'];
+        } elseif (isset($authorization_header)
+            && strstr(substr($authorization_header, 0, 5), 'Basic')) {
+
+            // decode the HTTP_AUTHORIZATION header on php-cgi server self
+            // on fcgid server the header name is AUTHORIZATION
+
+            $auth_hash = base64_decode(substr($authorization_header, 6));
+            list($this->auth_user, $this->auth_pw) = explode(':', $auth_hash);
+
+            // set all to null on a empty basic auth request
+
+            if ($this->auth_user == "") {
+                $this->auth_user = null;
+                $this->auth_pw = null;
+            }
+        } else {
+            $this->auth_user = null;
+            $this->auth_pw = null;
+        }
+    }
+
+    /**
+     * Output an authentication error message.  Use XML or JSON if one
+     * of those formats is specified, otherwise output plain text
+     *
+     * @return void
+     */
+
+    function showBasicAuthError()
+    {
+        header('HTTP/1.1 401 Unauthorized');
+        $msg = 'Could not authenticate you.';
+
+        if ($this->format == 'xml') {
+            header('Content-Type: application/xml; charset=utf-8');
+            $this->startXML();
+            $this->elementStart('hash');
+            $this->element('error', null, $msg);
+            $this->element('request', null, $_SERVER['REQUEST_URI']);
+            $this->elementEnd('hash');
+            $this->endXML();
+        } elseif ($this->format == 'json') {
+            header('Content-Type: application/json; charset=utf-8');
+            $error_array = array('error' => $msg,
+                                 'request' => $_SERVER['REQUEST_URI']);
+            print(json_encode($error_array));
+        } else {
+            header('Content-type: text/plain');
+            print "$msg\n";
+        }
+    }
+
+}