3 * StatusNet, the distributed open-source microblogging tool
5 * Authorize an OAuth request token
9 * LICENCE: This program is free software: you can redistribute it and/or modify
10 * it under the terms of the GNU Affero General Public License as published by
11 * the Free Software Foundation, either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU Affero General Public License for more details.
19 * You should have received a copy of the GNU Affero General Public License
20 * along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * @author Zach Copley <zach@status.net>
25 * @copyright 2010 StatusNet, Inc.
26 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
27 * @link http://status.net/
30 if (!defined('STATUSNET')) {
34 require_once INSTALLDIR . '/lib/apioauth.php';
37 * Authorize an OAuth request token
41 * @author Zach Copley <zach@status.net>
42 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
43 * @link http://status.net/
46 class ApiOauthAuthorizeAction extends ApiOauthAction
56 * Is this a read-only action?
58 * @return boolean false
61 function isReadOnly($args)
66 function prepare($args)
68 parent::prepare($args);
70 common_debug("apioauthauthorize");
72 $this->nickname = $this->trimmed('nickname');
73 $this->password = $this->arg('password');
74 $this->oauth_token = $this->arg('oauth_token');
75 $this->callback = $this->arg('oauth_callback');
76 $this->store = new ApiStatusNetOAuthDataStore();
83 // Look up the full req token
85 $req_token = $this->store->lookup_token(null,
89 if (empty($req_token)) {
91 common_debug("Couldn't find request token!");
93 $this->clientError(_('Bad request.'));
99 $app = new Oauth_application();
100 $app->consumer_key = $req_token->consumer_key;
101 $result = $app->find(true);
103 if (!empty($result)) {
108 common_debug("couldn't find the app!");
114 * Handle input, produce output
116 * Switches on request method; either shows the form or handles its input.
118 * @param array $args $_REQUEST data
123 function handle($args)
125 parent::handle($args);
127 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
133 // XXX: make better error messages
135 if (empty($this->oauth_token)) {
137 common_debug("No request token found.");
139 $this->clientError(_('Bad request.'));
143 if (!$this->getApp()) {
144 $this->clientError(_('Bad request.'));
148 $name = $this->app->name;
149 common_debug("Requesting auth for app: " . $name);
155 function handlePost()
157 common_debug("handlePost()");
159 // check session token for CSRF protection.
161 $token = $this->trimmed('token');
163 if (!$token || $token != common_session_token()) {
164 $this->showForm(_('There was a problem with your session token. '.
165 'Try again, please.'));
169 if (!$this->getApp()) {
170 $this->clientError(_('Bad request.'));
178 if (!common_logged_in()) {
179 $user = common_check_user($this->nickname, $this->password);
181 $this->showForm(_("Invalid nickname / password!"));
185 $user = common_current_user();
188 if ($this->arg('allow')) {
190 // mark the req token as authorized
192 $this->store->authorize_token($this->oauth_token);
194 // Check to see if there was a previous token associated
195 // with this user/app and kill it. If the user is doing this she
196 // probably doesn't want any old tokens anyway.
198 $appUser = Oauth_application_user::getByKeys($user, $this->app);
200 if (!empty($appUser)) {
201 $result = $appUser->delete();
204 common_log_db_error($appUser, 'DELETE', __FILE__);
205 throw new ServerException(_('DB error deleting OAuth app user.'));
210 // associated the authorized req token with the user and the app
212 $appUser = new Oauth_application_user();
214 $appUser->profile_id = $user->id;
215 $appUser->application_id = $this->app->id;
217 // Note: do not copy the access type from the application.
218 // The access type should always be 0 when the OAuth app
219 // user record has a request token associated with it.
220 // Access type gets assigned once an access token has been
221 // granted. The OAuth app user record then gets updated
222 // with the new access token and access type.
224 $appUser->token = $this->oauth_token;
225 $appUser->created = common_sql_now();
227 $result = $appUser->insert();
230 common_log_db_error($appUser, 'INSERT', __FILE__);
231 throw new ServerException(_('DB error inserting OAuth app user.'));
235 // if we have a callback redirect and provide the token
237 // A callback specified in the app setup overrides whatever
238 // is passed in with the request.
240 common_debug("Req token is authorized - doing callback");
242 if (!empty($this->app->callback_url)) {
243 $this->callback = $this->app->callback_url;
246 if (!empty($this->callback)) {
248 // XXX: Need better way to build this redirect url.
250 $target_url = $this->getCallback($this->callback,
251 array('oauth_token' => $this->oauth_token));
253 common_debug("Doing callback to $target_url");
255 common_redirect($target_url, 303);
257 common_debug("callback was empty!");
260 // otherwise inform the user that the rt was authorized
262 $this->elementStart('p');
264 // XXX: Do OAuth 1.0a verifier code
266 $this->raw(sprintf(_("The request token %s has been authorized. " .
267 'Please exchange it for an access token.'),
268 $this->oauth_token));
270 $this->elementEnd('p');
272 } else if ($this->arg('deny')) {
274 $this->elementStart('p');
276 $this->raw(sprintf(_("The request token %s has been denied."),
277 $this->oauth_token));
279 $this->elementEnd('p');
281 $this->clientError(_('Unexpected form submission.'));
286 function showForm($error=null)
288 $this->error = $error;
292 function showScripts()
294 parent::showScripts();
295 if (!common_logged_in()) {
296 $this->autofocus('nickname');
303 * @return string title of the page
308 return _('An application would like to connect to your account');
314 * Display a notice for how to use the page, or the
315 * error if it exists.
320 function showPageNotice()
323 $this->element('p', 'error', $this->error);
325 $instr = $this->getInstructions();
326 $output = common_markup_to_html($instr);
333 * Shows the authorization form.
338 function showContent()
340 $this->elementStart('form', array('method' => 'post',
341 'id' => 'form_login',
342 'class' => 'form_settings',
343 'action' => common_local_url('apioauthauthorize')));
345 $this->hidden('token', common_session_token());
346 $this->hidden('oauth_token', $this->oauth_token);
347 $this->hidden('oauth_callback', $this->callback);
349 $this->elementStart('fieldset');
351 $this->elementStart('ul');
352 $this->elementStart('li');
353 if (!empty($this->app->icon)) {
354 $this->element('img', array('src' => $this->app->icon));
356 $this->elementEnd('li');
357 $this->elementStart('li');
359 $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
360 'access and update' : 'access';
362 $msg = _("The application <b>%s</b> by <b>%s</b> would like " .
363 "the ability to <b>%s</b> your account data.");
365 $this->raw(sprintf($msg,
367 $this->app->organization,
370 $this->elementEnd('li');
371 $this->elementEnd('ul');
373 $this->elementEnd('fieldset');
375 if (!common_logged_in()) {
377 $this->elementStart('fieldset');
378 $this->element('legend', null, _('Login'));
379 $this->elementStart('ul', 'form_data');
380 $this->elementStart('li');
381 $this->input('nickname', _('Nickname'));
382 $this->elementEnd('li');
383 $this->elementStart('li');
384 $this->password('password', _('Password'));
385 $this->elementEnd('li');
386 $this->elementEnd('ul');
388 $this->elementEnd('fieldset');
392 $this->element('input', array('id' => 'deny_submit',
396 'value' => _('Deny')));
398 $this->element('input', array('id' => 'allow_submit',
402 'value' => _('Allow')));
404 $this->elementEnd('form');
408 * Instructions for using the form
410 * For "remembered" logins, we make the user re-login when they
411 * try to change settings. Different instructions for this case.
416 function getInstructions()
418 return _('Allow or deny access to your account information.');
425 * Shows different login/register actions.
430 function showLocalNav()