3 * StatusNet, the distributed open-source microblogging tool
5 * Authorize an OAuth request token
9 * LICENCE: This program is free software: you can redistribute it and/or modify
10 * it under the terms of the GNU Affero General Public License as published by
11 * the Free Software Foundation, either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU Affero General Public License for more details.
19 * You should have received a copy of the GNU Affero General Public License
20 * along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * @author Zach Copley <zach@status.net>
25 * @copyright 2010 StatusNet, Inc.
26 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
27 * @link http://status.net/
30 if (!defined('STATUSNET')) {
34 require_once INSTALLDIR . '/lib/apioauthstore.php';
37 * Authorize an OAuth request token
41 * @author Zach Copley <zach@status.net>
42 * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
43 * @link http://status.net/
46 class ApiOauthAuthorizeAction extends Action
56 * Is this a read-only action?
58 * @return boolean false
61 function isReadOnly($args)
66 function prepare($args)
68 parent::prepare($args);
70 common_debug(var_export($_REQUEST, true));
72 $this->nickname = $this->trimmed('nickname');
73 $this->password = $this->arg('password');
74 $this->oauth_token = $this->arg('oauth_token');
75 $this->callback = $this->arg('oauth_callback');
76 $this->store = new ApiStatusNetOAuthDataStore();
83 // Look up the full req token
85 $req_token = $this->store->lookup_token(null,
89 if (empty($req_token)) {
91 common_debug("Couldn't find request token!");
93 $this->clientError(_('Bad request.'));
99 $app = new Oauth_application();
100 $app->consumer_key = $req_token->consumer_key;
101 $result = $app->find(true);
103 if (!empty($result)) {
108 common_debug("couldn't find the app!");
114 * Handle input, produce output
116 * Switches on request method; either shows the form or handles its input.
118 * @param array $args $_REQUEST data
123 function handle($args)
125 parent::handle($args);
127 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
128 /* Use a session token for CSRF protection. */
129 $token = $this->trimmed('token');
130 if (!$token || $token != common_session_token()) {
131 $this->showForm(_('There was a problem with your session token. '.
132 'Try again, please.'));
140 common_debug('ApiOauthAuthorize::handle()');
142 if (empty($this->oauth_token)) {
144 common_debug("No request token found.");
146 $this->clientError(_('Bad request.'));
150 if (!$this->getApp()) {
151 $this->clientError(_('Bad request.'));
155 common_debug("Requesting auth for app: $app->name.");
161 function handlePost()
163 /* Use a session token for CSRF protection. */
165 $token = $this->trimmed('token');
167 if (!$token || $token != common_session_token()) {
168 $this->showForm(_('There was a problem with your session token. '.
169 'Try again, please.'));
173 if (!$this->getApp()) {
174 $this->clientError(_('Bad request.'));
178 // is the user already logged in?
182 if (!common_logged_in()) {
183 $user = common_check_user($this->nickname, $this->password);
185 $this->showForm(_("Invalid nickname / password!"));
190 if ($this->arg('allow')) {
192 $this->store->authorize_token($this->oauth_token);
194 // if we have a callback redirect and provide the token
196 if (!empty($this->callback)) {
197 $target_url = $this->callback . '?oauth_token=' . $this->oauth_token;
198 common_redirect($target_url, 303);
201 // otherwise inform the user that the rt was authorized
203 $this->elementStart('p');
205 // XXX: Do verifier code?
207 $this->raw(sprintf(_("The request token %s has been authorized. " .
208 'Please exchange it for an access token.'),
209 $this->oauth_token));
211 $this->elementEnd('p');
213 } else if ($this->arg('deny')) {
215 $this->elementStart('p');
217 $this->raw(sprintf(_("The request token %s has been denied."),
218 $this->oauth_token));
220 $this->elementEnd('p');
222 $this->clientError(_('Unexpected form submission.'));
227 function showForm($error=null)
229 $this->error = $error;
233 function showScripts()
235 parent::showScripts();
236 // $this->autofocus('nickname');
242 * @return string title of the page
247 return _('An application would like to connect to your account');
253 * Display a notice for how to use the page, or the
254 * error if it exists.
259 function showPageNotice()
262 $this->element('p', 'error', $this->error);
264 $instr = $this->getInstructions();
265 $output = common_markup_to_html($instr);
272 * Shows the authorization form.
277 function showContent()
279 $this->elementStart('form', array('method' => 'post',
280 'id' => 'form_login',
281 'class' => 'form_settings',
282 'action' => common_local_url('apioauthauthorize')));
284 $this->hidden('token', common_session_token());
285 $this->hidden('oauth_token', $this->oauth_token);
286 $this->hidden('oauth_callback', $this->callback);
288 $this->elementStart('fieldset');
290 $this->elementStart('ul');
291 $this->elementStart('li');
292 if (!empty($this->app->icon)) {
293 $this->element('img', array('src' => $this->app->icon));
295 $this->elementEnd('li');
296 $this->elementStart('li');
298 $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
299 'access and update' : 'access';
301 $msg = _("The application <b>%s</b> by <b>%s</b> would like " .
302 "the ability to <b>%s</b> your account data.");
304 $this->raw(sprintf($msg,
306 $this->app->organization,
309 $this->elementEnd('li');
310 $this->elementEnd('ul');
312 $this->elementEnd('fieldset');
314 if (!common_logged_in()) {
316 $this->elementStart('fieldset');
317 $this->element('legend', null, _('Login'));
318 $this->elementStart('ul', 'form_data');
319 $this->elementStart('li');
320 $this->input('nickname', _('Nickname'));
321 $this->elementEnd('li');
322 $this->elementStart('li');
323 $this->password('password', _('Password'));
324 $this->elementEnd('li');
325 $this->elementEnd('ul');
327 $this->elementEnd('fieldset');
331 $this->element('input', array('id' => 'deny_submit',
335 'value' => _('Deny')));
337 $this->element('input', array('id' => 'allow_submit',
341 'value' => _('Allow')));
343 $this->elementEnd('form');
347 * Instructions for using the form
349 * For "remembered" logins, we make the user re-login when they
350 * try to change settings. Different instructions for this case.
355 function getInstructions()
357 return _('Allow or deny access to your account information.');
364 * Shows different login/register actions.
369 function showLocalNav()