/*! @page authentication Authentication
- StatusNet supports HTTP Basic Authentication and OAuth for API calls.
+ GNU social supports HTTP Basic Authentication and OAuth for API calls.
@warning Currently, users who have created accounts without setting a
password via OpenID, Facebook Connect, etc., cannot use the API until
// NOTE: $this->scoped and $this->auth_user has to get set in
// prepare(), not handle(), as subclasses use them in prepares.
- // Allow regular login session
- if (common_logged_in()) {
+ // Allow regular login session, but we have to double-check the
+ // HTTP_REFERER value to avoid cross domain POSTing since the API
+ // doesn't use the "token" form field.
+ if (common_logged_in() && common_local_referer()) {
$this->scoped = Profile::current();
$this->auth_user = $this->scoped->getUser();
if (!$this->auth_user->hasRight(Right::API)) {
// TRANS: Authorization exception thrown when a user without API access tries to access the API.
throw new AuthorizationException(_('Not allowed to use API.'));
}
+ // Let's run this in the same way as if we've just authenticated the user (basic/oauth auth)
+ Event::handle('EndSetApiUser', array($this->auth_user));
$this->access = self::READ_WRITE;
} else {
$oauthReq = $this->getOAuthRequest();
// Set the auth user
if (Event::handle('StartSetApiUser', array(&$user))) {
$user = User::getKV('id', $appUser->profile_id);
- if (!empty($user)) {
- if (!$user->hasRight(Right::API)) {
- // TRANS: Authorization exception thrown when a user without API access tries to access the API.
- throw new AuthorizationException(_('Not allowed to use API.'));
- }
+ }
+ if ($user instanceof User) {
+ if (!$user->hasRight(Right::API)) {
+ // TRANS: Authorization exception thrown when a user without API access tries to access the API.
+ throw new AuthorizationException(_('Not allowed to use API.'));
}
$this->auth_user = $user;
- // FIXME: setting the value returned by common_current_user()
- // There should probably be a better method for this. common_set_user()
- // does lots of session stuff.
- global $_cur;
- $_cur = $this->auth_user;
- Event::handle('EndSetApiUser', array($user));
+ Event::handle('EndSetApiUser', array($this->auth_user));
+ } else {
+ // If $user is not a real User, let's force it to null.
+ $this->auth_user = null;
}
+ // FIXME: setting the value returned by common_current_user()
+ // There should probably be a better method for this. common_set_user()
+ // does lots of session stuff.
+ global $_cur;
+ $_cur = $this->auth_user;
+
$msg = "API OAuth authentication for user '%s' (id: %d) on behalf of " .
"application '%s' (id: %d) with %s access.";
// TRANS: Client error thrown when authentication fails because a user clicked "Cancel".
$this->clientError(_('Could not authenticate you.'), 401);
- } elseif ($required) {
+ } else {
+ // $this->auth_user_nickname - i.e. PHP_AUTH_USER - will have a value since it was not empty
$user = common_check_user($this->auth_user_nickname,
$this->auth_user_password);
- if (Event::handle('StartSetApiUser', array(&$user))) {
-
- if ($user instanceof User) {
- if (!$user->hasRight(Right::API)) {
- // TRANS: Authorization exception thrown when a user without API access tries to access the API.
- throw new AuthorizationException(_('Not allowed to use API.'));
- }
- $this->auth_user = $user;
+ Event::handle('StartSetApiUser', array(&$user));
+ if ($user instanceof User) {
+ if (!$user->hasRight(Right::API)) {
+ // TRANS: Authorization exception thrown when a user without API access tries to access the API.
+ throw new AuthorizationException(_('Not allowed to use API.'));
}
+ $this->auth_user = $user;
- Event::handle('EndSetApiUser', array($user));
+ Event::handle('EndSetApiUser', array($this->auth_user));
+ } else {
+ $this->auth_user = null;
}
- // By default, basic auth users have rw access
- $this->access = self::READ_WRITE;
-
- if (!$this->auth_user instanceof User && ($required || isset($_SERVER['PHP_AUTH_USER']))) {
+ if ($required && $this->auth_user instanceof User) {
+ // By default, basic auth users have rw access
+ $this->access = self::READ_WRITE;
+ } elseif ($required) {
$msg = sprintf(
"basic auth nickname = %s",
$this->auth_user_nickname
);
$this->logAuthFailure($msg);
+
+ // We must present WWW-Authenticate in accordance to HTTP status code 401
+ header('WWW-Authenticate: Basic realm="' . $realm . '"');
// TRANS: Client error thrown when authentication fails.
$this->clientError(_('Could not authenticate you.'), 401);
+ } else {
+ // all get rw access for actions that don't require auth
+ $this->access = self::READ_WRITE;
}
- } else {
- // all get rw access for actions that don't need auth
- $this->access = self::READ_WRITE;
}
}