Contact suggestions are now cached

[friendica.git] / src / Security / BasicAuth.php

diff --git a/src/Security/BasicAuth.php b/src/Security/BasicAuth.php
index 2f47a93378dcd31e5cc3be55ede8defd41c378a2..7c3f3cc9c4b5e5fba8c6e4de7459cfaf56603479 100644 (file)
--- a/src/Security/BasicAuth.php
+++ b/src/Security/BasicAuth.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @copyright Copyright (C) 2010-2021, the Friendica project
+ * @copyright Copyright (C) 2010-2022, the Friendica project
  *
  * @license GNU AGPL version 3 or any later version
  *
@@ -24,7 +24,6 @@ namespace Friendica\Security;
 use Exception;
 use Friendica\Core\Hook;
 use Friendica\Core\Logger;
-use Friendica\Core\Session;
 use Friendica\Database\DBA;
 use Friendica\DI;
 use Friendica\Model\User;
@@ -62,6 +61,11 @@ class BasicAuth
                return (int)self::$current_user_id;
        }
 
+       public static function setCurrentUserID(int $uid = null)
+       {
+               self::$current_user_id = $uid;
+       }
+
        /**
         * Fetch a dummy application token
         *
@@ -73,14 +77,31 @@ class BasicAuth
                        return [];
                }
 
-               if (!empty(self::$current_token)) {
-                       return self::$current_token;
+               //if (!empty(self::$current_token)) {
+               //      return self::$current_token;
+               //}
+
+               $source = $_REQUEST['source'] ?? '';
+
+               // Support for known clients that doesn't send a source name
+               if (empty($source) && !empty($_SERVER['HTTP_USER_AGENT'])) {
+                       if(strpos($_SERVER['HTTP_USER_AGENT'], "Twidere") !== false) {
+                               $source = 'Twidere';
+                       }
+
+                       Logger::info('Unrecognized user-agent', ['http_user_agent' => $_SERVER['HTTP_USER_AGENT']]);
+               } else {
+                       Logger::info('Empty user-agent');
+               }
+
+               if (empty($source)) {
+                       $source = 'api';
                }
 
                self::$current_token = [
                        'uid'        => self::$current_user_id,
                        'id'         => 0,
-                       'name'       => api_source(),
+                       'name'       => $source,
                        'website'    => '',
                        'created_at' => DBA::NULL_DATETIME,
                        'read'       => true,
@@ -101,45 +122,44 @@ class BasicAuth
        private static function getUserIdByAuth(bool $do_login = true):int
        {
                $a = DI::app();
-               Session::set('allow_api', false);
                self::$current_user_id = 0;
 
                // workaround for HTTP-auth in CGI mode
                if (!empty($_SERVER['REDIRECT_REMOTE_USER'])) {
                        $userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6));
-                       if (strlen($userpass)) {
+                       if (!empty($userpass) && strpos($userpass, ':')) {
                                list($name, $password) = explode(':', $userpass);
                                $_SERVER['PHP_AUTH_USER'] = $name;
                                $_SERVER['PHP_AUTH_PW'] = $password;
                        }
                }
 
-               $user = $_SERVER['PHP_AUTH_USER'] ?? '';
+               $user     = $_SERVER['PHP_AUTH_USER'] ?? '';
                $password = $_SERVER['PHP_AUTH_PW'] ?? '';
-       
+
                // allow "user@server" login (but ignore 'server' part)
                $at = strstr($user, "@", true);
                if ($at) {
                        $user = $at;
                }
-       
+
                // next code from mod/auth.php. needs better solution
                $record = null;
-       
+
                $addon_auth = [
                        'username' => trim($user),
                        'password' => trim($password),
                        'authenticated' => 0,
                        'user_record' => null,
                ];
-       
+
                /*
                * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
                * Addons should never set 'authenticated' except to indicate success - as hooks may be chained
                * and later addons should not interfere with an earlier one that succeeded.
                */
                Hook::callAll('authenticate', $addon_auth);
-       
+
                if ($addon_auth['authenticated'] && !empty($addon_auth['user_record'])) {
                        $record = $addon_auth['user_record'];
                } else {
@@ -148,32 +168,30 @@ class BasicAuth
                                $record = DBA::selectFirst('user', [], ['uid' => $user_id]);
                        } catch (Exception $ex) {
                                $record = [];
-                       }                       
+                       }
                }
-       
+
                if (empty($record)) {
                        if (!$do_login) {
                                return 0;
                        }
-                       Logger::debug('failed', ['module' => 'api', 'action' => 'login', 'parameters' => $_SERVER]);
-                       header('WWW-Authenticate: Basic realm="Friendica"');
+                       Logger::debug('Access denied', ['parameters' => $_SERVER]);
+                       // Checking for commandline for the tests, we have to avoid to send a header
+                       if (php_sapi_name() !== 'cli') {
+                               header('WWW-Authenticate: Basic realm="Friendica"');
+                       }
                        throw new UnauthorizedException("This API requires login");
                }
-       
+
                // Don't refresh the login date more often than twice a day to spare database writes
                $login_refresh = strcmp(DateTimeFormat::utc('now - 12 hours'), $record['login_date']) > 0;
-       
+
                DI::auth()->setForUser($a, $record, false, false, $login_refresh);
-       
-               Session::set('allow_api', true);
-       
-               Hook::callAll('logged_in', $a->user);
-       
-               if (Session::get('allow_api')) {
-                       self::$current_user_id = local_user();
-               } else {
-                       self::$current_user_id = 0;
-               }
+
+               Hook::callAll('logged_in', $record);
+
+               self::$current_user_id = DI::userSession()->getLocalUserId();
+
                return self::$current_user_id;
-       }       
+       }
 }