Renamed HTTPResponse class to StatusNet_HTTPResponse to avoid conflict with PECL...

[quix0rs-gnu-social.git] / lib / apiauth.php

diff --git a/lib/apiauth.php b/lib/apiauth.php
index d441014addfaa1c283b6d79d3555055de9be6325..e78de618ee2a4eb1713278d2592a54efd828c127 100644 (file)
--- a/lib/apiauth.php
+++ b/lib/apiauth.php
@@ -38,7 +38,6 @@ if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/api.php';
 require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
@@ -55,11 +54,11 @@ class ApiAuthAction extends ApiAction
 {
     var $auth_user_nickname = null;
     var $auth_user_password = null;
-    var $access_token       = null;
     var $oauth_source       = null;
 
     /**
-     * Take arguments for running, and output basic auth header if needed
+     * Take arguments for running, looks for an OAuth request,
+     * and outputs basic auth header if needed
      *
      * @param array $args $_REQUEST args
      *
@@ -71,34 +70,26 @@ class ApiAuthAction extends ApiAction
     {
         parent::prepare($args);
 
-        $this->consumer_key = $this->arg('oauth_consumer_key');
-        $this->access_token = $this->arg('oauth_token');
-
         // NOTE: $this->auth_user has to get set in prepare(), not handle(),
         // because subclasses do stuff with it in their prepares.
 
-        if ($this->requiresAuth()) {
-            if (!empty($this->access_token)) {
-                $this->checkOAuthRequest();
-            } else {
-                $this->checkBasicAuthUser(true);
-            }
-        } else {
-
-            // Check to see if a basic auth user is there even
-            // if one's not required
+        $oauthReq = $this->getOAuthRequest();
 
-            if (empty($this->access_token)) {
+        if (!$oauthReq) {
+            if ($this->requiresAuth()) {
+                $this->checkBasicAuthUser(true);
+            } else {
+                // Check to see if a basic auth user is there even
+                // if one's not required
                 $this->checkBasicAuthUser(false);
             }
+        } else {
+            $this->checkOAuthRequest($oauthReq);
         }
 
         // Reject API calls with the wrong access level
 
         if ($this->isReadOnly($args) == false) {
-
-            common_debug(get_class($this) . ' is not read-only!');
-
             if ($this->access != self::READ_WRITE) {
                 $msg = _('API resource requires read-write access, ' .
                          'but you only have read access.');
@@ -110,12 +101,42 @@ class ApiAuthAction extends ApiAction
         return true;
     }
 
-    function handle($args)
+    /**
+     * Determine whether the request is an OAuth request.
+     * This is to avoid doign any unnecessary DB lookups.
+     *
+     * @return mixed the OAuthRequest or false
+     */
+
+    function getOAuthRequest()
     {
-        parent::handle($args);
+        ApiOauthAction::cleanRequest();
+
+        $req  = OAuthRequest::from_request();
+
+        $consumer    = $req->get_parameter('oauth_consumer_key');
+        $accessToken = $req->get_parameter('oauth_token');
+
+        // XXX: Is it good enough to assume it's not meant to be an
+        // OAuth request if there is no consumer or token? --Z
+
+        if (empty($consumer) || empty($accessToken)) {
+            return false;
+        }
+
+        return $req;
     }
 
-    function checkOAuthRequest()
+    /**
+     * Verifies the OAuth request signature, sets the auth user
+     * and access type (read-only or read-write)
+     *
+     * @param OAuthRequest $request the OAuth Request
+     *
+     * @return nothing
+     */
+
+    function checkOAuthRequest($request)
     {
         $datastore   = new ApiStatusNetOAuthDataStore();
         $server      = new OAuthServer($datastore);
@@ -123,22 +144,19 @@ class ApiAuthAction extends ApiAction
 
         $server->add_signature_method($hmac_method);
 
-        ApiOauthAction::cleanRequest();
-
         try {
 
-            $req  = OAuthRequest::from_request();
-            $server->verify_request($req);
+            $server->verify_request($request);
 
-            $app = Oauth_application::getByConsumerKey($this->consumer_key);
+            $consumer     = $request->get_parameter('oauth_consumer_key');
+            $access_token = $request->get_parameter('oauth_token');
 
-            if (empty($app)) {
+            $app = Oauth_application::getByConsumerKey($consumer);
 
-                // this should probably not happen
+            if (empty($app)) {
                 common_log(LOG_WARNING,
                            'Couldn\'t find the OAuth app for consumer key: ' .
-                           $this->consumer_key);
-
+                           $consumer);
                 throw new OAuthException('No application for that consumer key.');
             }
 
@@ -146,11 +164,7 @@ class ApiAuthAction extends ApiAction
 
             $this->oauth_source = $app->name;
 
-            $appUser = Oauth_application_user::staticGet('token',
-                                                         $this->access_token);
-
-            // XXX: Check that app->id and appUser->application_id and consumer all
-            // match?
+            $appUser = Oauth_application_user::staticGet('token', $access_token);
 
             if (!empty($appUser)) {
 
@@ -164,6 +178,8 @@ class ApiAuthAction extends ApiAction
                     $this->access = ($appUser->access_type & Oauth_application::$writeAccess)
                       ? self::READ_WRITE : self::READ_ONLY;
 
+                    // Set the auth user
+
                     if (Event::handle('StartSetApiUser', array(&$user))) {
                         $this->auth_user = User::staticGet('id', $appUser->profile_id);
                         Event::handle('EndSetApiUser', array($user));
@@ -180,7 +196,6 @@ class ApiAuthAction extends ApiAction
                                                  ($this->access = self::READ_WRITE) ?
                                                  'read-write' : 'read-only'
                                                  ));
-                    return;
                 } else {
                     throw new OAuthException('Bad access token.');
                 }
@@ -220,9 +235,13 @@ class ApiAuthAction extends ApiAction
     {
         $this->basicAuthProcessHeader();
 
-        $realm = common_config('site', 'name') . ' API';
+        $realm = common_config('api', 'realm');
+
+        if (empty($realm)) {
+            $realm = common_config('site', 'name') . ' API';
+        }
 
-        if (!isset($this->auth_user_nickname) && $required) {
+        if (empty($this->auth_user_nickname) && $required) {
             header('WWW-Authenticate: Basic realm="' . $realm . '"');
 
             // show error if the user clicks 'cancel'
@@ -248,7 +267,7 @@ class ApiAuthAction extends ApiAction
 
             $this->access = self::READ_WRITE;
 
-            if (empty($this->auth_user) && $required) {
+            if (empty($this->auth_user) && ($required || isset($_SERVER['PHP_AUTH_USER']))) {
 
                 // basic authentication failed
 
@@ -275,11 +294,15 @@ class ApiAuthAction extends ApiAction
 
     function basicAuthProcessHeader()
     {
-        if (isset($_SERVER['AUTHORIZATION'])
-            || isset($_SERVER['HTTP_AUTHORIZATION'])
-            ) {
-            $authorization_header = isset($_SERVER['HTTP_AUTHORIZATION'])
-              ? $_SERVER['HTTP_AUTHORIZATION'] : $_SERVER['AUTHORIZATION'];
+        $authHeaders = array('AUTHORIZATION',
+                             'HTTP_AUTHORIZATION',
+                             'REDIRECT_HTTP_AUTHORIZATION'); // rewrite for CGI
+        $authorization_header = null;
+        foreach ($authHeaders as $header) {
+            if (isset($_SERVER[$header])) {
+                $authorization_header = $_SERVER[$header];
+                break;
+            }
         }
 
         if (isset($_SERVER['PHP_AUTH_USER'])) {