Merge remote branch 'upstream/master'

[friendica.git] / include / auth.php

diff --git a/include/auth.php b/include/auth.php
old mode 100755 (executable)
new mode 100644 (file)
index f2975c4..cba6a67
--- a/include/auth.php
+++ b/include/auth.php
@@ -11,6 +11,13 @@ function nuke_session() {
        unset($_SESSION['cid']);
        unset($_SESSION['theme']);
        unset($_SESSION['page_flags']);
+       unset($_SESSION['submanage']);
+       unset($_SESSION['my_url']);
+       unset($_SESSION['my_address']);
+       unset($_SESSION['addr']);
+       unset($_SESSION['return_url']);
+       unset($_SESSION['theme']);
+       unset($_SESSION['page_flags']);
 }
 
 
@@ -46,6 +53,8 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
                $check = get_config('system','paranoia');
                // extra paranoia - if the IP changed, log them out
                if($check && ($_SESSION['addr'] != $_SERVER['REMOTE_ADDR'])) {
+                       logger('Session address changed. Paranoid setting in effect, blocking session. ' 
+                               . $_SESSION['addr'] . ' != ' . $_SERVER['REMOTE_ADDR']);
                        nuke_session();
                        goaway(z_root());
                }
@@ -77,7 +86,7 @@ else {
 
                        $noid = get_config('system','no_openid');
 
-                       $openid_url = trim(  (strlen($_POST['openid_url'])?$_POST['openid_url']:$_POST['username']) );
+                       $openid_url = trim((strlen($_POST['openid_url'])?$_POST['openid_url']:$_POST['username']) );
 
                        // validate_url alters the calling parameter
 
@@ -94,37 +103,21 @@ else {
 
                        // Otherwise it's probably an openid.
 
+                        try {
                        require_once('library/openid.php');
                        $openid = new LightOpenID;
                        $openid->identity = $openid_url;
                        $_SESSION['openid'] = $openid_url;
                        $a = get_app();
-                       $openid->returnUrl = $a->get_baseurl() . '/openid'; 
-
-                       $r = q("SELECT `uid` FROM `user` WHERE `openid` = '%s' LIMIT 1",
-                               dbesc($openid_url)
-                       );
-                       if(count($r)) { 
-                               // existing account
-                               goaway($openid->authUrl());
-                               // NOTREACHED   
-                       }
-                       else {
-                               if($a->config['register_policy'] == REGISTER_CLOSED) {
-                                       $a = get_app();
-                                       notice( t('Login failed.') . EOL);
-                                       goaway(z_root());
-                                       // NOTREACHED
-                               }
-                               // new account
-                               $_SESSION['register'] = 1;
-                               $openid->required = array('namePerson/friendly', 'contact/email', 'namePerson');
-                               $openid->optional = array('namePerson/first','media/image/aspect11','media/image/default');
-                               goaway($openid->authUrl());
-                               // NOTREACHED   
-                       }
+                       $openid->returnUrl = $a->get_baseurl(true) . '/openid'; 
+                        goaway($openid->authUrl());
+                        } catch (Exception $e) {
+                            notice( t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.').'<br /><br >'. t('The error message was:').' '.$e->getMessage());
+                        }
+                       // NOTREACHED
                }
        }
+
        if((x($_POST,'auth-params')) && $_POST['auth-params'] === 'login') {
 
                $record = null;
@@ -165,7 +158,7 @@ else {
                }
 
                if((! $record) || (! count($record))) {
-                       logger('authenticate: failed login attempt: ' . notags(trim($_POST['username']))); 
+                       logger('authenticate: failed login attempt: ' . notags(trim($_POST['username'])) . ' from IP ' . $_SERVER['REMOTE_ADDR']); 
                        notice( t('Login failed.') . EOL );
                        goaway(z_root());
                }