Enable AntiBrute by default.

[quix0rs-gnu-social.git] / lib / apiauthaction.php

diff --git a/lib/apiauthaction.php b/lib/apiauthaction.php
index 54b05b3d52c49d5fa4a9bf509ec92eb2ff1d4c31..40161b7ab57c4a73cc25086961a61accd6fbd7bc 100644 (file)
--- a/lib/apiauthaction.php
+++ b/lib/apiauthaction.php
@@ -53,9 +53,7 @@
 
 */
 
-if (!defined('STATUSNET')) {
-    exit(1);
-}
+if (!defined('GNUSOCIAL')) { exit(1); }
 
 /**
  * Actions extending this class will require auth
@@ -80,34 +78,45 @@ class ApiAuthAction extends ApiAction
      * @return boolean success flag
      *
      */
-    function prepare($args)
+    protected function prepare(array $args=array())
     {
         parent::prepare($args);
 
-        // NOTE: $this->auth_user has to get set in prepare(), not handle(),
-        // because subclasses do stuff with it in their prepares.
+        // NOTE: $this->scoped and $this->auth_user has to get set in
+        // prepare(), not handle(), as subclasses use them in prepares.
 
-        $oauthReq = $this->getOAuthRequest();
+        // Allow regular login session
+        if (common_logged_in()) {
+            $this->scoped = Profile::current();
+            $this->auth_user = $this->scoped->getUser();
+            if (!$this->auth_user->hasRight(Right::API)) {
+                // TRANS: Authorization exception thrown when a user without API access tries to access the API.
+                throw new AuthorizationException(_('Not allowed to use API.'));
+            }
+            $this->access = self::READ_WRITE;
+        } else {
+            $oauthReq = $this->getOAuthRequest();
 
-        if (!$oauthReq) {
-            if ($this->requiresAuth()) {
-                $this->checkBasicAuthUser(true);
+            if ($oauthReq instanceof OAuthRequest) {
+                $this->checkOAuthRequest($oauthReq);
             } else {
-                // Check to see if a basic auth user is there even
-                // if one's not required
-                $this->checkBasicAuthUser(false);
+                // If not using OAuth, check if there is a basic auth
+                // and require it if the current action requires it.
+                $this->checkBasicAuthUser($this->requiresAuth());
             }
-        } else {
-            $this->checkOAuthRequest($oauthReq);
-        }
 
-        // NOTE: Make sure we're scoped properly based on the auths!
-        if (isset($this->auth_user) && !empty($this->auth_user)) {
-            $this->scoped = $this->auth_user->getProfile();
-        } else {
-            $this->scoped = null;
+            // NOTE: Make sure we're scoped properly based on the auths!
+            if (isset($this->auth_user) && $this->auth_user instanceof User) {
+                $this->scoped = $this->auth_user->getProfile();
+            } else {
+                $this->scoped = null;
+            }
         }
 
+        // legacy user transferral
+        // TODO: remove when sure no extended classes need it
+        $this->user = $this->auth_user;
+
         // Reject API calls with the wrong access level
 
         if ($this->isReadOnly($args) == false) {
@@ -115,8 +124,7 @@ class ApiAuthAction extends ApiAction
                 // TRANS: Client error 401.
                 $msg = _('API resource requires read-write access, ' .
                          'but you only have read access.');
-                $this->clientError($msg, 401, $this->format);
-                exit;
+                $this->clientError($msg, 401);
             }
         }
 
@@ -158,7 +166,7 @@ class ApiAuthAction extends ApiAction
      */
     function checkOAuthRequest($request)
     {
-        $datastore   = new ApiGNUSocialOAuthDataStore();
+        $datastore   = new ApiGNUsocialOAuthDataStore();
         $server      = new OAuthServer($datastore);
         $hmac_method = new OAuthSignatureMethod_HMAC_SHA1();
 
@@ -214,7 +222,7 @@ class ApiAuthAction extends ApiAction
                         // does lots of session stuff.
                         global $_cur;
                         $_cur = $this->auth_user;
-                        Event::handle('EndSetApiUser', array($user)); 
+                        Event::handle('EndSetApiUser', array($user));
                     }
 
                     $msg = "API OAuth authentication for user '%s' (id: %d) on behalf of " .
@@ -244,8 +252,7 @@ class ApiAuthAction extends ApiAction
         } catch (OAuthException $e) {
             $this->logAuthFailure($e->getMessage());
             common_log(LOG_WARNING, 'API OAuthException - ' . $e->getMessage());
-            $this->clientError($e->getMessage(), 401, $this->format);
-            exit;
+            $this->clientError($e->getMessage(), 401);
         }
     }
 
@@ -254,7 +261,7 @@ class ApiAuthAction extends ApiAction
      *
      * @return boolean true
      */
-    function requiresAuth()
+    public function requiresAuth()
     {
         return true;
     }
@@ -279,18 +286,18 @@ class ApiAuthAction extends ApiAction
             header('WWW-Authenticate: Basic realm="' . $realm . '"');
 
             // show error if the user clicks 'cancel'
-            // TRANS: Client error thrown when authentication fails becaus a user clicked "Cancel".
-            $this->clientError(_('Could not authenticate you.'), 401, $this->format);
-            exit;
+            // TRANS: Client error thrown when authentication fails because a user clicked "Cancel".
+            $this->clientError(_('Could not authenticate you.'), 401);
 
-        } else {
+        } elseif ($required) {
+            // $this->auth_user_nickname - i.e. PHP_AUTH_USER - will have a value since it was not empty
 
             $user = common_check_user($this->auth_user_nickname,
                                       $this->auth_user_password);
 
             if (Event::handle('StartSetApiUser', array(&$user))) {
 
-                if (!empty($user)) {
+                if ($user instanceof User) {
                     if (!$user->hasRight(Right::API)) {
                         // TRANS: Authorization exception thrown when a user without API access tries to access the API.
                         throw new AuthorizationException(_('Not allowed to use API.'));
@@ -304,16 +311,21 @@ class ApiAuthAction extends ApiAction
             // By default, basic auth users have rw access
             $this->access = self::READ_WRITE;
 
-            if (empty($this->auth_user) && ($required || isset($_SERVER['PHP_AUTH_USER']))) {
+            if (!$this->auth_user instanceof User) {
                 $msg = sprintf(
                     "basic auth nickname = %s",
                     $this->auth_user_nickname
                 );
                 $this->logAuthFailure($msg);
+
+                // We must present WWW-Authenticate in accordance to HTTP status code 401
+                header('WWW-Authenticate: Basic realm="' . $realm . '"');
                 // TRANS: Client error thrown when authentication fails.
-                $this->clientError(_('Could not authenticate you.'), 401, $this->format);
-                exit;
+                $this->clientError(_('Could not authenticate you.'), 401);
             }
+        } else {
+            // all get rw access for actions that don't require auth
+            $this->access = self::READ_WRITE;
         }
     }