From b9d40f723bce8e01ddcbbb989bd7035b92cd9af8 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Mon, 2 Nov 2009 18:40:18 -0500 Subject: Added 'login' command that gives you a link that can be used to login to the website --- actions/login.php | 55 ++++++++++++++++++++++++++++++++++------------ classes/Login_token.php | 42 +++++++++++++++++++++++++++++++++++ classes/statusnet.ini | 11 ++++++++++ db/08to09.sql | 10 +++++++++ db/08to09_pg.sql | 10 +++++++++ db/statusnet.sql | 10 +++++++++ db/statusnet_pg.sql | 10 +++++++++ lib/command.php | 27 +++++++++++++++++++++++ lib/commandinterpreter.php | 6 +++++ lib/router.php | 2 ++ 10 files changed, 169 insertions(+), 14 deletions(-) create mode 100644 classes/Login_token.php diff --git a/actions/login.php b/actions/login.php index f6d016310..ad57dd667 100644 --- a/actions/login.php +++ b/actions/login.php @@ -79,6 +79,8 @@ class LoginAction extends Action $this->clientError(_('Already logged in.')); } else if ($_SERVER['REQUEST_METHOD'] == 'POST') { $this->checkLogin(); + } else if (isset($args['user_id']) && isset($args['token'])){ + $this->checkLogin($args['user_id'],$args['token']); } else { common_ensure_session(); $this->showForm(); @@ -95,23 +97,48 @@ class LoginAction extends Action * @return void */ - function checkLogin() + function checkLogin($user_id=null, $token=null) { - // XXX: login throttle - - // CSRF protection - token set in NoticeForm - $token = $this->trimmed('token'); - if (!$token || $token != common_session_token()) { - $this->clientError(_('There was a problem with your session token. '. - 'Try again, please.')); - return; + if(isset($token) && isset($user_id)){ + //Token based login (from the LoginCommand) + $login_token = Login_token::staticGet('user_id',$user_id); + if($login_token && $login_token->token == $token){ + if($login_token->modified > time()+2*60){ + //token has expired + //delete the token as it is useless + $login_token->delete(); + $this->showForm(_('Invalid or expired token.')); + return; + }else{ + //delete the token so it cannot be reused + $login_token->delete(); + //it's a valid token - let them log in + $user = User::staticGet('id', $user_id); + //$user = User::staticGet('nickname', "candrews"); + } + }else{ + $this->showForm(_('Invalid or expired token.')); + return; + } + }else{ + // Regular form submission login + + // XXX: login throttle + + // CSRF protection - token set in NoticeForm + $token = $this->trimmed('token'); + if (!$token || $token != common_session_token()) { + $this->clientError(_('There was a problem with your session token. '. + 'Try again, please.')); + return; + } + + $nickname = common_canonical_nickname($this->trimmed('nickname')); + $password = $this->arg('password'); + + $user = common_check_user($nickname, $password); } - $nickname = common_canonical_nickname($this->trimmed('nickname')); - $password = $this->arg('password'); - - $user = common_check_user($nickname, $password); - if (!$user) { $this->showForm(_('Incorrect username or password.')); return; diff --git a/classes/Login_token.php b/classes/Login_token.php new file mode 100644 index 000000000..bd6381f90 --- /dev/null +++ b/classes/Login_token.php @@ -0,0 +1,42 @@ +. + */ + +if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); } + +require_once INSTALLDIR.'/classes/Memcached_DataObject.php'; + +class Login_token extends Memcached_DataObject +{ + ###START_AUTOCODE + /* the code below is auto generated do not remove the above tag */ + + public $__table = 'login_token'; // table name + public $user_id; // int(4) primary_key not_null + public $token; // char(32) not_null + public $created; // datetime() not_null + public $modified; // timestamp() not_null default_CURRENT_TIMESTAMP + + /* Static get */ + function staticGet($k,$v=NULL) { return DB_DataObject::staticGet('Login_token',$k,$v); } + + /* the code above is auto generated do not remove the tag below */ + ###END_AUTOCODE +} diff --git a/classes/statusnet.ini b/classes/statusnet.ini index 623790b10..912d05cdf 100644 --- a/classes/statusnet.ini +++ b/classes/statusnet.ini @@ -555,3 +555,14 @@ created = 142 [user_role__keys] user_id = K role = K + +[login_token] +user_id = 129 +token = 130 +created = 142 +modified = 384 + +[login_token__keys] +user_id = K +token = K + diff --git a/db/08to09.sql b/db/08to09.sql index 953e0e5f4..a0e37f0f1 100644 --- a/db/08to09.sql +++ b/db/08to09.sql @@ -32,3 +32,13 @@ create table user_role ( constraint primary key (user_id, role) ) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; + +create table login_token ( + user_id integer not null comment 'user owning this token' references user (id), + token char(32) not null comment 'token useable for logging in', + created datetime not null comment 'date this record was created', + modified timestamp comment 'date this record was modified', + + constraint primary key (user_id) +) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; + diff --git a/db/08to09_pg.sql b/db/08to09_pg.sql index 9e37314aa..197fcabfd 100644 --- a/db/08to09_pg.sql +++ b/db/08to09_pg.sql @@ -38,3 +38,13 @@ create table user_role ( primary key (user_id, role) ); + +create table login_token ( + user_id integer not null /* comment 'user owning this token'*/ references user (id), + token char(32) not null /* comment 'token useable for logging in'*/, + created timestamp not null DEFAULT CURRENT_TIMESTAMP /* comment 'date this record was created'*/, + modified timestamp /* comment 'date this record was modified'*/, + + constraint primary key (user_id) +); + diff --git a/db/statusnet.sql b/db/statusnet.sql index 1524d8395..3ed4e2c48 100644 --- a/db/statusnet.sql +++ b/db/statusnet.sql @@ -575,3 +575,13 @@ create table location_namespace ( modified timestamp comment 'date this record was modified' ) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; + +create table login_token ( + user_id integer not null comment 'user owning this token' references user (id), + token char(32) not null comment 'token useable for logging in', + created datetime not null comment 'date this record was created', + modified timestamp comment 'date this record was modified', + + constraint primary key (user_id) +) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; + diff --git a/db/statusnet_pg.sql b/db/statusnet_pg.sql index 672877ddf..0e5e96c32 100644 --- a/db/statusnet_pg.sql +++ b/db/statusnet_pg.sql @@ -569,3 +569,13 @@ create table user_role ( primary key (user_id, role) ); + +create table login_token ( + user_id integer not null /* comment 'user owning this token'*/ references user (id), + token char(32) not null /* comment 'token useable for logging in'*/, + created timestamp not null DEFAULT CURRENT_TIMESTAMP /* comment 'date this record was created'*/, + modified timestamp /* comment 'date this record was modified'*/, + + constraint primary key (user_id) +); + diff --git a/lib/command.php b/lib/command.php index 9efa40696..2ec3320de 100644 --- a/lib/command.php +++ b/lib/command.php @@ -579,6 +579,32 @@ class OnCommand extends Command } } +class LoginCommand extends Command +{ + function execute($channel) + { + $login_token = Login_token::staticGet('user_id',$this->user->id); + if($login_token){ + $login_token->delete(); + } + $login_token = new Login_token(); + $login_token->user_id = $this->user->id; + $login_token->token = common_good_rand(16); + $login_token->created = common_sql_now(); + $result = $login_token->insert(); + if (!$result) { + common_log_db_error($login_token, 'INSERT', __FILE__); + $channel->error($this->user, sprintf(_('Could not create login token for %s'), + $this->user->nickname)); + return; + } + $channel->output($this->user, + sprintf(_('This link is useable only once, and is good for only 2 minutes: %s'), + common_local_url('login', + array('user_id'=>$login_token->user_id, 'token'=>$login_token->token)))); + } +} + class HelpCommand extends Command { function execute($channel) @@ -598,6 +624,7 @@ class HelpCommand extends Command "reply # - reply to notice with a given id\n". "reply - reply to the last notice from user\n". "join - join group\n". + "login - Get a link to login to the web interface\n". "drop - leave group\n". "stats - get your stats\n". "stop - same as 'off'\n". diff --git a/lib/commandinterpreter.php b/lib/commandinterpreter.php index b921a17cc..d878fe268 100644 --- a/lib/commandinterpreter.php +++ b/lib/commandinterpreter.php @@ -41,6 +41,12 @@ class CommandInterpreter return null; } return new HelpCommand($user); + case 'login': + if ($arg) { + return null; + } else { + return new LoginCommand($user); + } case 'on': if ($arg) { list($other, $extra) = $this->split_arg($arg); diff --git a/lib/router.php b/lib/router.php index 888cbdd20..0ddda473c 100644 --- a/lib/router.php +++ b/lib/router.php @@ -88,6 +88,8 @@ class Router $m->connect('doc/:title', array('action' => 'doc')); + $m->connect('main/login?user_id=:user_id&token=:token', array('action'=>'login'), array('user_id'=> '[0-9]+', 'token'=>'.+')); + // main stuff is repetitive $main = array('login', 'logout', 'register', 'subscribe', -- cgit v1.2.3-54-g00ecf