3 * StatusNet, the distributed open-source microblogging tool
5 * Authorize an OAuth request token
9 * LICENCE: This program is free software: you can redistribute it and/or modify
10 * it under the terms of the GNU Affero General Public License as published by
11 * the Free Software Foundation, either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU Affero General Public License for more details.
19 * You should have received a copy of the GNU Affero General Public License
20 * along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * @author Zach Copley <zach@status.net>
25 * @copyright 2010 StatusNet, Inc.
26 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
27 * @link http://status.net/
30 if (!defined('STATUSNET')) {
34 require_once INSTALLDIR . '/lib/apioauth.php';
37 * Authorize an OAuth request token
41 * @author Zach Copley <zach@status.net>
42 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
43 * @link http://status.net/
46 class ApiOauthAuthorizeAction extends ApiOauthAction
56 * Is this a read-only action?
58 * @return boolean false
61 function isReadOnly($args)
66 function prepare($args)
68 parent::prepare($args);
70 common_debug("apioauthauthorize");
72 $this->nickname = $this->trimmed('nickname');
73 $this->password = $this->arg('password');
74 $this->oauth_token = $this->arg('oauth_token');
75 $this->callback = $this->arg('oauth_callback');
76 $this->store = new ApiStatusNetOAuthDataStore();
77 $this->app = $this->store->getAppByRequestToken($this->oauth_token);
83 * Handle input, produce output
85 * Switches on request method; either shows the form or handles its input.
87 * @param array $args $_REQUEST data
92 function handle($args)
94 parent::handle($args);
96 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
102 if (empty($this->oauth_token)) {
103 $this->clientError(_('No oauth_token parameter provided.'));
107 if (empty($this->app)) {
108 $this->clientError(_('Invalid token.'));
112 $name = $this->app->name;
118 function handlePost()
120 // check session token for CSRF protection.
122 $token = $this->trimmed('token');
124 if (!$token || $token != common_session_token()) {
125 $this->showForm(_('There was a problem with your session token. '.
126 'Try again, please.'));
134 if (!common_logged_in()) {
135 $user = common_check_user($this->nickname, $this->password);
137 $this->showForm(_("Invalid nickname / password!"));
141 $user = common_current_user();
144 if ($this->arg('allow')) {
146 // mark the req token as authorized
148 $this->store->authorize_token($this->oauth_token);
150 // Check to see if there was a previous token associated
151 // with this user/app and kill it. If the user is doing this she
152 // probably doesn't want any old tokens anyway.
154 $appUser = Oauth_application_user::getByKeys($user, $this->app);
156 if (!empty($appUser)) {
157 $result = $appUser->delete();
160 common_log_db_error($appUser, 'DELETE', __FILE__);
161 throw new ServerException(_('Database error deleting OAuth application user.'));
166 // associated the authorized req token with the user and the app
168 $appUser = new Oauth_application_user();
170 $appUser->profile_id = $user->id;
171 $appUser->application_id = $this->app->id;
173 // Note: do not copy the access type from the application.
174 // The access type should always be 0 when the OAuth app
175 // user record has a request token associated with it.
176 // Access type gets assigned once an access token has been
177 // granted. The OAuth app user record then gets updated
178 // with the new access token and access type.
180 $appUser->token = $this->oauth_token;
181 $appUser->created = common_sql_now();
183 $result = $appUser->insert();
186 common_log_db_error($appUser, 'INSERT', __FILE__);
187 throw new ServerException(_('Database error inserting OAuth application user.'));
191 // if we have a callback redirect and provide the token
193 // A callback specified in the app setup overrides whatever
194 // is passed in with the request.
196 common_debug("Req token is authorized - doing callback");
198 if (!empty($this->app->callback_url)) {
199 $this->callback = $this->app->callback_url;
202 if (!empty($this->callback)) {
204 $target_url = $this->getCallback($this->callback,
205 array('oauth_token' => $this->oauth_token));
207 common_redirect($target_url, 303);
209 common_debug("callback was empty!");
212 // otherwise inform the user that the rt was authorized
214 $this->elementStart('p');
216 // XXX: Do OAuth 1.0a verifier code
218 $this->raw(sprintf(_("The request token %s has been authorized. " .
219 'Please exchange it for an access token.'),
220 $this->oauth_token));
222 $this->elementEnd('p');
224 } else if ($this->arg('deny')) {
226 $datastore = new ApiStatusNetOAuthDataStore();
227 $datastore->revoke_token($this->oauth_token, 0);
229 $this->elementStart('p');
231 $this->raw(sprintf(_("The request token %s has been denied and revoked."),
232 $this->oauth_token));
234 $this->elementEnd('p');
236 $this->clientError(_('Unexpected form submission.'));
241 function showForm($error=null)
243 $this->error = $error;
247 function showScripts()
249 parent::showScripts();
250 if (!common_logged_in()) {
251 $this->autofocus('nickname');
258 * @return string title of the page
263 return _('An application would like to connect to your account');
267 * Shows the authorization form.
272 function showContent()
274 $this->elementStart('form', array('method' => 'post',
275 'id' => 'form_apioauthauthorize',
276 'class' => 'form_settings',
277 'action' => common_local_url('apioauthauthorize')));
278 $this->elementStart('fieldset');
279 $this->element('legend', array('id' => 'apioauthauthorize_allowdeny'),
280 _('Allow or deny access'));
282 $this->hidden('token', common_session_token());
283 $this->hidden('oauth_token', $this->oauth_token);
284 $this->hidden('oauth_callback', $this->callback);
286 $this->elementStart('ul', 'form_data');
287 $this->elementStart('li');
288 $this->elementStart('p');
289 if (!empty($this->app->icon)) {
290 $this->element('img', array('src' => $this->app->icon));
293 $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
294 'access and update' : 'access';
296 $msg = _('The application <strong>%1$s</strong> by ' .
297 '<strong>%2$s</strong> would like the ability ' .
298 'to <strong>%3$s</strong> your account data.');
300 $this->raw(sprintf($msg,
302 $this->app->organization,
304 $this->elementEnd('p');
305 $this->elementEnd('li');
306 $this->elementEnd('ul');
308 if (!common_logged_in()) {
310 $this->elementStart('fieldset');
311 $this->element('legend', null, _('Account'));
312 $this->elementStart('ul', 'form_data');
313 $this->elementStart('li');
314 $this->input('nickname', _('Nickname'));
315 $this->elementEnd('li');
316 $this->elementStart('li');
317 $this->password('password', _('Password'));
318 $this->elementEnd('li');
319 $this->elementEnd('ul');
321 $this->elementEnd('fieldset');
325 $this->element('input', array('id' => 'deny_submit',
326 'class' => 'submit submit form_action-primary',
329 'value' => _('Deny')));
331 $this->element('input', array('id' => 'allow_submit',
332 'class' => 'submit submit form_action-secondary',
335 'value' => _('Allow')));
337 $this->elementEnd('fieldset');
338 $this->elementEnd('form');
342 * Instructions for using the form
344 * For "remembered" logins, we make the user re-login when they
345 * try to change settings. Different instructions for this case.
350 function getInstructions()
352 return _('Allow or deny access to your account information.');
358 * Shows different login/register actions.
363 function showLocalNav()