From f4f56eea3ae349ed7d47ae7385036107510bf5e5 Mon Sep 17 00:00:00 2001 From: Zach Copley Date: Tue, 5 Oct 2010 17:48:32 -0700 Subject: Override new_request_token() to store OAuth 1.0a verified callback URL --- lib/apioauthstore.php | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'lib/apioauthstore.php') diff --git a/lib/apioauthstore.php b/lib/apioauthstore.php index eca93866f..620f0947f 100644 --- a/lib/apioauthstore.php +++ b/lib/apioauthstore.php @@ -183,4 +183,30 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore throw new Exception(_('Failed to delete revoked token.')); } } + + /* + * Create a new request token. Overrided to support OAuth 1.0a callback + * + * @param OAuthConsumer $consumer the OAuth Consumer for this token + * @param string $callback the verified OAuth callback URL + * + * @return OAuthToken $token a new unauthorized OAuth request token + */ + + function new_request_token($consumer, $callback) + { + $t = new Token(); + $t->consumer_key = $consumer->key; + $t->tok = common_good_rand(16); + $t->secret = common_good_rand(16); + $t->type = 0; // request + $t->state = 0; // unauthorized + $t->verified_callback = $callback; + $t->created = DB_DataObject_Cast::dateTime(); + if (!$t->insert()) { + return null; + } else { + return new OAuthToken($t->tok, $t->secret); + } + } } -- cgit v1.2.3-54-g00ecf From 69e621a3e882cd060eb4314554aada7167edd897 Mon Sep 17 00:00:00 2001 From: Zach Copley Date: Wed, 6 Oct 2010 19:20:47 -0700 Subject: - Update ApiOauthAuthorizeAction to 1.0a - Fix enumerable bugs - New page for displaying 1.0a verifier (still needs work) --- actions/apioauthauthorize.php | 231 ++++++++++++++++++++++++++++++++---------- actions/apioauthpin.php | 69 +++++++++++++ lib/apioauth.php | 27 +---- lib/apioauthstore.php | 8 ++ lib/oauthstore.php | 11 ++ lib/serverexception.php | 2 +- 6 files changed, 270 insertions(+), 78 deletions(-) create mode 100644 actions/apioauthpin.php (limited to 'lib/apioauthstore.php') diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php index c2fbbcdd8..6772052f2 100644 --- a/actions/apioauthauthorize.php +++ b/actions/apioauthauthorize.php @@ -32,6 +32,7 @@ if (!defined('STATUSNET')) { } require_once INSTALLDIR . '/lib/apioauth.php'; +require_once INSTALLDIR . '/lib/info.php'; /** * Authorize an OAuth request token @@ -43,9 +44,10 @@ require_once INSTALLDIR . '/lib/apioauth.php'; * @link http://status.net/ */ -class ApiOauthAuthorizeAction extends ApiOauthAction +class ApiOauthAuthorizeAction extends Action { - var $oauth_token; + var $oauthTokenParam; + var $reqToken; var $callback; var $app; var $nickname; @@ -67,12 +69,17 @@ class ApiOauthAuthorizeAction extends ApiOauthAction { parent::prepare($args); - $this->nickname = $this->trimmed('nickname'); - $this->password = $this->arg('password'); - $this->oauth_token = $this->arg('oauth_token'); - $this->callback = $this->arg('oauth_callback'); - $this->store = new ApiStatusNetOAuthDataStore(); - $this->app = $this->store->getAppByRequestToken($this->oauth_token); + $this->nickname = $this->trimmed('nickname'); + $this->password = $this->arg('password'); + $this->oauthTokenParam = $this->arg('oauth_token'); + $this->callback = $this->arg('oauth_callback'); + $this->store = new ApiStatusNetOAuthDataStore(); + + try { + $this->app = $this->store->getAppByRequestToken($this->oauthTokenParam); + } catch (Exception $e) { + $this->clientError($e->getMessage()); + } return true; } @@ -97,14 +104,30 @@ class ApiOauthAuthorizeAction extends ApiOauthAction } else { - if (empty($this->oauth_token)) { + // Make sure a oauth_token parameter was provided + if (empty($this->oauthTokenParam)) { $this->clientError(_('No oauth_token parameter provided.')); - return; + } else { + + // Check to make sure the token exists + $this->reqToken = $this->store->getTokenByKey($this->oauthTokenParam); + + if (empty($this->reqToken)) { + $this->serverError( + _('Invalid request token.') + ); + } else { + + // Check to make sure we haven't already authorized the token + if ($this->reqToken->state != 0) { + $this->clientError("Invalid request token."); + } + } } + // make sure there's an app associated with this token if (empty($this->app)) { - $this->clientError(_('Invalid token.')); - return; + $this->clientError(_('Invalid request token.')); } $name = $this->app->name; @@ -120,8 +143,8 @@ class ApiOauthAuthorizeAction extends ApiOauthAction $token = $this->trimmed('token'); if (!$token || $token != common_session_token()) { - $this->showForm(_('There was a problem with your session token. '. - 'Try again, please.')); + $this->showForm( + _('There was a problem with your session token. Try again, please.')); return; } @@ -130,6 +153,11 @@ class ApiOauthAuthorizeAction extends ApiOauthAction $user = null; if (!common_logged_in()) { + + // XXX Force credentials check? + + // XXX OpenID + $user = common_check_user($this->nickname, $this->password); if (empty($user)) { $this->showForm(_("Invalid nickname / password!")); @@ -141,9 +169,15 @@ class ApiOauthAuthorizeAction extends ApiOauthAction if ($this->arg('allow')) { - // mark the req token as authorized + // fetch the token + $this->reqToken = $this->store->getTokenByKey($this->oauthTokenParam); - $this->store->authorize_token($this->oauth_token); + // mark the req token as authorized + try { + $this->store->authorize_token($this->oauthTokenParam); + } catch (Exception $e) { + $this->serverError($e->getMessage()); + } // Check to see if there was a previous token associated // with this user/app and kill it. If the user is doing this she @@ -156,8 +190,7 @@ class ApiOauthAuthorizeAction extends ApiOauthAction if (!$result) { common_log_db_error($appUser, 'DELETE', __FILE__); - throw new ServerException(_('Database error deleting OAuth application user.')); - return; + $this->serverError(_('Database error deleting OAuth application user.')); } } @@ -175,20 +208,19 @@ class ApiOauthAuthorizeAction extends ApiOauthAction // granted. The OAuth app user record then gets updated // with the new access token and access type. - $appUser->token = $this->oauth_token; + $appUser->token = $this->oauthTokenParam; $appUser->created = common_sql_now(); $result = $appUser->insert(); if (!$result) { common_log_db_error($appUser, 'INSERT', __FILE__); - throw new ServerException(_('Database error inserting OAuth application user.')); - return; + $this->serverError(_('Database error inserting OAuth application user.')); } - // if we have a callback redirect and provide the token + // If we have a callback redirect and provide the token - // A callback specified in the app setup overrides whatever + // Note: A callback specified in the app setup overrides whatever // is passed in with the request. if (!empty($this->app->callback_url)) { @@ -197,40 +229,40 @@ class ApiOauthAuthorizeAction extends ApiOauthAction if (!empty($this->callback)) { - $target_url = $this->getCallback($this->callback, - array('oauth_token' => $this->oauth_token)); + $targetUrl = $this->getCallback( + $this->callback, + array( + 'oauth_token' => $this->oauthTokenParam, + 'oauth_verifier' => $this->reqToken->verifier // 1.0a + ) + ); + + // Redirect the user to the provided OAuth callback + common_redirect($targetUrl, 303); - common_redirect($target_url, 303); } else { - common_debug("callback was empty!"); + common_log( + LOG_INFO, + "No oauth_callback parameter provided for application ID " + . $this->app->id + . " when authorizing request token." + ); } - // otherwise inform the user that the rt was authorized - - $this->elementStart('p'); - - // XXX: Do OAuth 1.0a verifier code - - $this->raw(sprintf(_("The request token %s has been authorized. " . - 'Please exchange it for an access token.'), - $this->oauth_token)); + // Otherwise, inform the user that the rt was authorized + $this->showAuthorized(); - $this->elementEnd('p'); + } else if ($this->arg('cancel')) { - } else if ($this->arg('deny')) { - - $datastore = new ApiStatusNetOAuthDataStore(); - $datastore->revoke_token($this->oauth_token, 0); - - $this->elementStart('p'); - - $this->raw(sprintf(_("The request token %s has been denied and revoked."), - $this->oauth_token)); + try { + $this->store->revoke_token($this->oauthTokenParam, 0); + $this->showCanceled(); + } catch (Exception $e) { + $this->ServerError($e->getMessage()); + } - $this->elementEnd('p'); } else { $this->clientError(_('Unexpected form submission.')); - return; } } @@ -276,7 +308,7 @@ class ApiOauthAuthorizeAction extends ApiOauthAction _('Allow or deny access')); $this->hidden('token', common_session_token()); - $this->hidden('oauth_token', $this->oauth_token); + $this->hidden('oauth_token', $this->oauthTokenParam); $this->hidden('oauth_callback', $this->callback); $this->elementStart('ul', 'form_data'); @@ -321,11 +353,11 @@ class ApiOauthAuthorizeAction extends ApiOauthAction } - $this->element('input', array('id' => 'deny_submit', + $this->element('input', array('id' => 'cancel_submit', 'class' => 'submit submit form_action-primary', - 'name' => 'deny', + 'name' => 'cancel', 'type' => 'submit', - 'value' => _('Deny'))); + 'value' => _('Cancel'))); $this->element('input', array('id' => 'allow_submit', 'class' => 'submit submit form_action-secondary', @@ -348,7 +380,7 @@ class ApiOauthAuthorizeAction extends ApiOauthAction function getInstructions() { - return _('Allow or deny access to your account information.'); + return _('Authorize access to your account information.'); } /** @@ -388,4 +420,97 @@ class ApiOauthAuthorizeAction extends ApiOauthAction // NOP } + /* + * Show a nice message confirming the authorization + * operation was canceled. + * + * @return nothing + */ + + function showCanceled() + { + $info = new InfoAction( + _('Authorization canceled.'), + sprintf( + _('The request token %s has been revoked.'), + $this->oauthTokenParm + ) + ); + + $info->showPage(); + } + + /* + * Show a nice message that the authorization was successful. + * If the operation is out-of-band, show a pin. + * + * @return nothing + */ + + function showAuthorized() + { + + if ($this->reqToken->verified_callback == 'oob') { + + $pin = new ApiOauthPinAction($this->reqToken->verifier); + $pin->showPage(); + + } else { + + $info = new InfoAction( + _("Authorization succeeded."), + sprintf( + _('The request token %s has been authorized. Please exchange it for an access token using this verifier: %s'), + $this->oauthTokenParam, + $this->reqToken->verifier + ) + ); + + $info->showPage(); + } + } + + /* + * Properly format the callback URL and parameters so it's + * suitable for a redirect in the OAuth dance + * + * @param string $url the URL + * @param array $params an array of parameters + * + * @return string $url a URL to use for redirecting to + */ + + function getCallback($url, $params) + { + foreach ($params as $k => $v) { + $url = $this->appendQueryVar( + $url, + OAuthUtil::urlencode_rfc3986($k), + OAuthUtil::urlencode_rfc3986($v) + ); + } + + return $url; + } + + /* + * Append a new query parameter after any existing query + * parameters. + * + * @param string $url the URL + * @prarm string $k the parameter name + * @param string $v value of the paramter + * + * @return string $url the new URL with added parameter + */ + + function appendQueryVar($url, $k, $v) { + $url = preg_replace('/(.*)(\?|&)' . $k . '=[^&]+?(&)(.*)/i', '$1$2$4', $url . '&'); + $url = substr($url, 0, -1); + if (strpos($url, '?') === false) { + return ($url . '?' . $k . '=' . $v); + } else { + return ($url . '&' . $k . '=' . $v); + } + } } diff --git a/actions/apioauthpin.php b/actions/apioauthpin.php new file mode 100644 index 000000000..5a88b5e59 --- /dev/null +++ b/actions/apioauthpin.php @@ -0,0 +1,69 @@ +. + * + * @category Action + * @package StatusNet + * @author Zach Copley + * @copyright 2010 StatusNet, Inc. + * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0 + * @link http://status.net/ + */ + +if (!defined('STATUSNET') && !defined('LACONICA')) { + exit(1); +} + +require_once INSTALLDIR . '/lib/info.php'; + +/** + * Class for displaying an OAuth verifier pin + * + * @category Action + * @package StatusNet + * @author Zach Copley + * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0 + * @link http://status.net/ + */ + +class ApiOauthPinAction extends InfoAction +{ + + function __construct($verifier) + { + $this->verifier = $verifier; + $title = _('Authorization succeeded.'); + parent::__construct($title, $title); + } + + // TODO: Check for logged in state! + + /** + * Display content. + * + * @return nothing + */ + function showContent() + { + // XXX: make this much nicer + $this->element('div', array('class' => 'info'), $this->verifier); + } + +} diff --git a/lib/apioauth.php b/lib/apioauth.php index 75b0b3c57..54cecf92a 100644 --- a/lib/apioauth.php +++ b/lib/apioauth.php @@ -34,9 +34,8 @@ require_once INSTALLDIR . '/lib/apiaction.php'; require_once INSTALLDIR . '/lib/apioauthstore.php'; /** - * Base action for API OAuth enpoints. Clean up the - * the request, and possibly some other common things - * here. + * Base action for API OAuth enpoints. Clean up the + * request. Some other common functions. * * @category API * @package StatusNet @@ -82,6 +81,7 @@ class ApiOauthAction extends ApiAction * any extra parameters or anything else it's not expecting. * I'm looking at you, p parameter. */ + static function cleanRequest() { // kill evil effects of magical slashing @@ -106,25 +106,4 @@ class ApiOauthAction extends ApiAction $_SERVER['QUERY_STRING'] = implode('&', $queryArray); } - function getCallback($url, $params) - { - foreach ($params as $k => $v) { - $url = $this->appendQueryVar($url, - OAuthUtil::urlencode_rfc3986($k), - OAuthUtil::urlencode_rfc3986($v)); - } - - return $url; - } - - function appendQueryVar($url, $k, $v) { - $url = preg_replace('/(.*)(\?|&)' . $k . '=[^&]+?(&)(.*)/i', '$1$2$4', $url . '&'); - $url = substr($url, 0, -1); - if (strpos($url, '?') === false) { - return ($url . '?' . $k . '=' . $v); - } else { - return ($url . '&' . $k . '=' . $v); - } - } - } diff --git a/lib/apioauthstore.php b/lib/apioauthstore.php index 620f0947f..4d141286b 100644 --- a/lib/apioauthstore.php +++ b/lib/apioauthstore.php @@ -202,6 +202,14 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore $t->type = 0; // request $t->state = 0; // unauthorized $t->verified_callback = $callback; + + if ($callback === 'oob') { + // six digit pin + $t->verifier = mt_rand(0, 999999); + } else { + $t->verifier = common_good_rand(8); + } + $t->created = DB_DataObject_Cast::dateTime(); if (!$t->insert()) { return null; diff --git a/lib/oauthstore.php b/lib/oauthstore.php index f3ee629fd..537667678 100644 --- a/lib/oauthstore.php +++ b/lib/oauthstore.php @@ -55,6 +55,17 @@ class StatusNetOAuthDataStore extends OAuthDataStore } } + function getTokenByKey($token_key) + { + $t = new Token(); + $t->tok = $token_key; + if ($t->find(true)) { + return $t; + } else { + return null; + } + } + // http://oauth.net/core/1.0/#nonce // "The Consumer SHALL then generate a Nonce value that is unique for // all requests with that timestamp." diff --git a/lib/serverexception.php b/lib/serverexception.php index 7dc9765ad..0dfbd04ff 100644 --- a/lib/serverexception.php +++ b/lib/serverexception.php @@ -22,7 +22,7 @@ * @category Exception * @package StatusNet * @author Evan Prodromou - * @copyright 2008 StatusNet, Inc. + * @copyright 2008-2010 StatusNet, Inc. * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0 * @link http://status.net/ */ -- cgit v1.2.3-54-g00ecf From 8658e4f8c4186574ac6503428be3ed534290387d Mon Sep 17 00:00:00 2001 From: Zach Copley Date: Thu, 7 Oct 2010 11:01:17 -0700 Subject: Use 7 digits for oob OAuth pin instead of 6 --- lib/apioauthstore.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/apioauthstore.php') diff --git a/lib/apioauthstore.php b/lib/apioauthstore.php index 4d141286b..7a4fe8db5 100644 --- a/lib/apioauthstore.php +++ b/lib/apioauthstore.php @@ -205,7 +205,7 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore if ($callback === 'oob') { // six digit pin - $t->verifier = mt_rand(0, 999999); + $t->verifier = mt_rand(0, 9999999); } else { $t->verifier = common_good_rand(8); } -- cgit v1.2.3-54-g00ecf From 459727bd610df5e579311a1627ee9b0e93ac44b0 Mon Sep 17 00:00:00 2001 From: Zach Copley Date: Thu, 7 Oct 2010 18:32:27 -0700 Subject: Update ApiOauthAccessTokenAction to OAuth 1.0a --- actions/apioauthaccesstoken.php | 56 ++++++++++++++++++++++++++++++++--------- lib/apioauthstore.php | 34 +++++++++++++++---------- 2 files changed, 65 insertions(+), 25 deletions(-) (limited to 'lib/apioauthstore.php') diff --git a/actions/apioauthaccesstoken.php b/actions/apioauthaccesstoken.php index 887df4c20..b8b188b1d 100644 --- a/actions/apioauthaccesstoken.php +++ b/actions/apioauthaccesstoken.php @@ -2,7 +2,8 @@ /** * StatusNet, the distributed open-source microblogging tool * - * Exchange an authorized OAuth request token for an access token + * Action for getting OAuth token credentials (exchange an authorized + * request token for an access token) * * PHP version 5 * @@ -34,7 +35,8 @@ if (!defined('STATUSNET')) { require_once INSTALLDIR . '/lib/apioauth.php'; /** - * Exchange an authorized OAuth request token for an access token + * Action for getting OAuth token credentials (exchange an authorized + * request token for an access token) * * @category API * @package StatusNet @@ -45,6 +47,8 @@ require_once INSTALLDIR . '/lib/apioauth.php'; class ApiOauthAccessTokenAction extends ApiOauthAction { + protected $reqToken = null; + protected $verifier = null; /** * Class handler. @@ -65,30 +69,58 @@ class ApiOauthAccessTokenAction extends ApiOauthAction $atok = null; + // XXX: Insist that oauth_token and oauth_verifier be populated? + // Spec doesn't say they MUST be. + try { + $req = OAuthRequest::from_request(); + + $this->reqToken = $req->get_parameter('oauth_token'); + $this->verifier = $req->get_parameter('oauth_verifier'); + $atok = $server->fetch_access_token($req); } catch (OAuthException $e) { common_log(LOG_WARNING, 'API OAuthException - ' . $e->getMessage()); common_debug(var_export($req, true)); - $this->outputError($e->getMessage()); - return; + $code = $e->getCode(); + $this->clientError($e->getMessage(), empty($code) ? 401 : $code, 'text'); } if (empty($atok)) { - common_debug('couldn\'t get access token.'); - print "Token exchange failed. Has the request token been authorized?\n"; + + // Token exchange failed -- log it + + list($proxy, $ip) = common_client_ip(); + + $msg = sprintf( + 'API OAuth - Failure exchanging request token for access token, ' + . 'request token = %s, verifier = %s, IP = %s, proxy = %s', + $this->reqToken, + $this->verifier, + $ip, + $proxy + ); + + common_log(LOG_WARNING, $msg); + + print "Invalid request token or verifier."; + } else { - print $atok; + $this->showAccessToken($atok); } } - function outputError($msg) + /* + * Display OAuth token credentials + * + * @param OAuthToken token the access token + */ + + function showAccessToken($token) { - header('HTTP/1.1 401 Unauthorized'); - header('Content-Type: text/html; charset=utf-8'); - print $msg . "\n"; + header('Content-Type: application/x-www-form-urlencoded'); + print $token; } } - diff --git a/lib/apioauthstore.php b/lib/apioauthstore.php index 7a4fe8db5..4b52ba1ba 100644 --- a/lib/apioauthstore.php +++ b/lib/apioauthstore.php @@ -71,29 +71,33 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore } } - function new_access_token($token, $consumer) + function new_access_token($token, $consumer, $verifier) { - common_debug('new_access_token("'.$token->key.'","'.$consumer->key.'")', __FILE__); + common_debug( + 'new_access_token("' . $token->key . '","' . $consumer->key. '","' . $verifier . '")', + __FILE__ + ); $rt = new Token(); + $rt->consumer_key = $consumer->key; - $rt->tok = $token->key; - $rt->type = 0; // request + $rt->tok = $token->key; + $rt->type = 0; // request $app = Oauth_application::getByConsumerKey($consumer->key); + assert(!empty($app)); - if (empty($app)) { - common_debug("empty app!"); - } + if ($rt->find(true) && $rt->state == 1 && $rt->verifier == $verifier) { // authorized - if ($rt->find(true) && $rt->state == 1) { // authorized common_debug('request token found.', __FILE__); // find the associated user of the app $appUser = new Oauth_application_user(); + $appUser->application_id = $app->id; - $appUser->token = $rt->tok; + $appUser->token = $rt->tok; + $result = $appUser->find(true); if (!empty($result)) { @@ -106,10 +110,12 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore // go ahead and make the access token $at = new Token(); - $at->consumer_key = $consumer->key; - $at->tok = common_good_rand(16); - $at->secret = common_good_rand(16); - $at->type = 1; // access + $at->consumer_key = $consumer->key; + $at->tok = common_good_rand(16); + $at->secret = common_good_rand(16); + $at->type = 1; // access + $at->verifier = $verifier; + $at->verified_callback = $rt->verified_callback; // 1.0a $at->created = DB_DataObject_Cast::dateTime(); if (!$at->insert()) { @@ -217,4 +223,6 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore return new OAuthToken($t->tok, $t->secret); } } + + } -- cgit v1.2.3-54-g00ecf From 5270e931311af0f644ebd4302833ad3bb89b81d4 Mon Sep 17 00:00:00 2001 From: Zach Copley Date: Tue, 12 Oct 2010 16:20:09 -0700 Subject: Spelling - OAuth not Oath --- lib/apioauthstore.php | 2 +- lib/connectsettingsaction.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'lib/apioauthstore.php') diff --git a/lib/apioauthstore.php b/lib/apioauthstore.php index 4b52ba1ba..f3bf0b857 100644 --- a/lib/apioauthstore.php +++ b/lib/apioauthstore.php @@ -101,7 +101,7 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore $result = $appUser->find(true); if (!empty($result)) { - common_debug("Oath app user found."); + common_debug("Ouath app user found."); } else { common_debug("Oauth app user not found. app id $app->id token $rt->tok"); return null; diff --git a/lib/connectsettingsaction.php b/lib/connectsettingsaction.php index bb2e86176..325276c5f 100644 --- a/lib/connectsettingsaction.php +++ b/lib/connectsettingsaction.php @@ -116,9 +116,9 @@ class ConnectSettingsNav extends Widget } $menu['oauthconnectionssettings'] = array( - // TRANS: Menu item for OAth connection settings. + // TRANS: Menu item for OuAth connection settings. _m('MENU','Connections'), - // TRANS: Tooltip for connected applications (Connections through OAth) menu item. + // TRANS: Tooltip for connected applications (Connections through OAuth) menu item. _('Authorized connected applications') ); -- cgit v1.2.3-54-g00ecf