3 * StatusNet, the distributed open-source microblogging tool
5 * Authorize an OAuth request token
9 * LICENCE: This program is free software: you can redistribute it and/or modify
10 * it under the terms of the GNU Affero General Public License as published by
11 * the Free Software Foundation, either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU Affero General Public License for more details.
19 * You should have received a copy of the GNU Affero General Public License
20 * along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * @author Zach Copley <zach@status.net>
25 * @copyright 2010 StatusNet, Inc.
26 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
27 * @link http://status.net/
30 if (!defined('STATUSNET')) {
34 require_once INSTALLDIR . '/lib/apioauth.php';
37 * Authorize an OAuth request token
41 * @author Zach Copley <zach@status.net>
42 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
43 * @link http://status.net/
46 class ApiOauthAuthorizeAction extends ApiOauthAction
56 * Is this a read-only action?
58 * @return boolean false
61 function isReadOnly($args)
66 function prepare($args)
68 parent::prepare($args);
70 common_debug("apioauthauthorize");
72 $this->nickname = $this->trimmed('nickname');
73 $this->password = $this->arg('password');
74 $this->oauth_token = $this->arg('oauth_token');
75 $this->callback = $this->arg('oauth_callback');
76 $this->store = new ApiStatusNetOAuthDataStore();
77 $this->app = $this->store->getAppByRequestToken($this->oauth_token);
83 * Handle input, produce output
85 * Switches on request method; either shows the form or handles its input.
87 * @param array $args $_REQUEST data
92 function handle($args)
94 parent::handle($args);
96 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
102 // XXX: make better error messages
104 if (empty($this->oauth_token)) {
106 common_debug("No request token found.");
108 $this->clientError(_('Bad request.'));
112 if (empty($this->app)) {
113 common_debug('No app for that token.');
114 $this->clientError(_('Bad request.'));
118 $name = $this->app->name;
119 common_debug("Requesting auth for app: " . $name);
125 function handlePost()
127 common_debug("handlePost()");
129 // check session token for CSRF protection.
131 $token = $this->trimmed('token');
133 if (!$token || $token != common_session_token()) {
134 $this->showForm(_('There was a problem with your session token. '.
135 'Try again, please.'));
143 if (!common_logged_in()) {
144 $user = common_check_user($this->nickname, $this->password);
146 $this->showForm(_("Invalid nickname / password!"));
150 $user = common_current_user();
153 if ($this->arg('allow')) {
155 // mark the req token as authorized
157 $this->store->authorize_token($this->oauth_token);
159 // Check to see if there was a previous token associated
160 // with this user/app and kill it. If the user is doing this she
161 // probably doesn't want any old tokens anyway.
163 $appUser = Oauth_application_user::getByKeys($user, $this->app);
165 if (!empty($appUser)) {
166 $result = $appUser->delete();
169 common_log_db_error($appUser, 'DELETE', __FILE__);
170 throw new ServerException(_('DB error deleting OAuth app user.'));
175 // associated the authorized req token with the user and the app
177 $appUser = new Oauth_application_user();
179 $appUser->profile_id = $user->id;
180 $appUser->application_id = $this->app->id;
182 // Note: do not copy the access type from the application.
183 // The access type should always be 0 when the OAuth app
184 // user record has a request token associated with it.
185 // Access type gets assigned once an access token has been
186 // granted. The OAuth app user record then gets updated
187 // with the new access token and access type.
189 $appUser->token = $this->oauth_token;
190 $appUser->created = common_sql_now();
192 $result = $appUser->insert();
195 common_log_db_error($appUser, 'INSERT', __FILE__);
196 throw new ServerException(_('DB error inserting OAuth app user.'));
200 // if we have a callback redirect and provide the token
202 // A callback specified in the app setup overrides whatever
203 // is passed in with the request.
205 common_debug("Req token is authorized - doing callback");
207 if (!empty($this->app->callback_url)) {
208 $this->callback = $this->app->callback_url;
211 if (!empty($this->callback)) {
213 // XXX: Need better way to build this redirect url.
215 $target_url = $this->getCallback($this->callback,
216 array('oauth_token' => $this->oauth_token));
218 common_debug("Doing callback to $target_url");
220 common_redirect($target_url, 303);
222 common_debug("callback was empty!");
225 // otherwise inform the user that the rt was authorized
227 $this->elementStart('p');
229 // XXX: Do OAuth 1.0a verifier code
231 $this->raw(sprintf(_("The request token %s has been authorized. " .
232 'Please exchange it for an access token.'),
233 $this->oauth_token));
235 $this->elementEnd('p');
237 } else if ($this->arg('deny')) {
239 $this->elementStart('p');
241 $this->raw(sprintf(_("The request token %s has been denied."),
242 $this->oauth_token));
244 $this->elementEnd('p');
246 $this->clientError(_('Unexpected form submission.'));
251 function showForm($error=null)
253 $this->error = $error;
257 function showScripts()
259 parent::showScripts();
260 if (!common_logged_in()) {
261 $this->autofocus('nickname');
268 * @return string title of the page
273 return _('An application would like to connect to your account');
277 * Shows the authorization form.
282 function showContent()
284 $this->elementStart('form', array('method' => 'post',
285 'id' => 'form_apioauthauthorize',
286 'class' => 'form_settings',
287 'action' => common_local_url('apioauthauthorize')));
288 $this->elementStart('fieldset');
289 $this->element('legend', array('id' => 'apioauthauthorize_allowdeny'),
290 _('Allow or deny access'));
292 $this->hidden('token', common_session_token());
293 $this->hidden('oauth_token', $this->oauth_token);
294 $this->hidden('oauth_callback', $this->callback);
296 $this->elementStart('ul', 'form_data');
297 $this->elementStart('li');
298 $this->elementStart('p');
299 if (!empty($this->app->icon)) {
300 $this->element('img', array('src' => $this->app->icon));
303 $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
304 'access and update' : 'access';
306 $msg = _('The application <strong>%1$s</strong> by ' .
307 '<strong>%2$s</strong> would like the ability ' .
308 'to <strong>%3$s</strong> your account data.');
310 $this->raw(sprintf($msg,
312 $this->app->organization,
314 $this->elementEnd('p');
315 $this->elementEnd('li');
316 $this->elementEnd('ul');
318 if (!common_logged_in()) {
320 $this->elementStart('fieldset');
321 $this->element('legend', null, _('Account'));
322 $this->elementStart('ul', 'form_data');
323 $this->elementStart('li');
324 $this->input('nickname', _('Nickname'));
325 $this->elementEnd('li');
326 $this->elementStart('li');
327 $this->password('password', _('Password'));
328 $this->elementEnd('li');
329 $this->elementEnd('ul');
331 $this->elementEnd('fieldset');
335 $this->element('input', array('id' => 'deny_submit',
336 'class' => 'submit submit form_action-primary',
339 'value' => _('Deny')));
341 $this->element('input', array('id' => 'allow_submit',
342 'class' => 'submit submit form_action-secondary',
345 'value' => _('Allow')));
347 $this->elementEnd('fieldset');
348 $this->elementEnd('form');
352 * Instructions for using the form
354 * For "remembered" logins, we make the user re-login when they
355 * try to change settings. Different instructions for this case.
360 function getInstructions()
362 return _('Allow or deny access to your account information.');
368 * Shows different login/register actions.
373 function showLocalNav()