Date check added for HTTP signatures

[friendica.git] / src / Util / ExAuth.php

diff --git a/src/Util/ExAuth.php b/src/Util/ExAuth.php
index c68cd41166668d5b428f29557da7d74492c876f8..28157c23ef7285bc3443c1f0abbb2ed4765ec225 100644 (file)
--- a/src/Util/ExAuth.php
+++ b/src/Util/ExAuth.php
@@ -13,14 +13,14 @@
  * Installation:
  *
  *     - Change it's owner to whichever user is running the server, ie. ejabberd
- *       $ chown ejabberd:ejabberd /path/to/friendica/scripts/auth_ejabberd.php
+ *       $ chown ejabberd:ejabberd /path/to/friendica/bin/auth_ejabberd.php
  *
  *     - Change the access mode so it is readable only to the user ejabberd and has exec
- *       $ chmod 700 /path/to/friendica/scripts/auth_ejabberd.php
+ *       $ chmod 700 /path/to/friendica/bin/auth_ejabberd.php
  *
  *     - Edit your ejabberd.cfg file, comment out your auth_method and add:
  *       {auth_method, external}.
- *       {extauth_program, "/path/to/friendica/script/auth_ejabberd.php"}.
+ *       {extauth_program, "/path/to/friendica/bin/auth_ejabberd.php"}.
  *
  *     - Restart your ejabberd service, you should be able to login with your friendica auth info
  *
@@ -36,17 +36,13 @@ namespace Friendica\Util;
 
 use Friendica\Core\Config;
 use Friendica\Core\PConfig;
-use Friendica\Database\DBM;
+use Friendica\Database\DBA;
 use Friendica\Model\User;
-use dba;
-
-require_once 'include/dba.php';
 
 class ExAuth
 {
        private $bDebug;
        private $host;
-       private $pidfile;
 
        /**
         * @brief Create the class
@@ -72,7 +68,7 @@ class ExAuth
        {
                while (!feof(STDIN)) {
                        // Quit if the database connection went down
-                       if (!dba::connected()) {
+                       if (!DBA::connected()) {
                                $this->writeLog(LOG_ERR, 'the database connection went down');
                                return;
                        }
@@ -126,7 +122,7 @@ class ExAuth
         */
        private function isUser(array $aCommand)
        {
-               $a = get_app();
+               $a = \get_app();
 
                // Check if there is a username
                if (!isset($aCommand[1])) {
@@ -140,12 +136,12 @@ class ExAuth
                $this->setHost($aCommand[2]);
 
                // Now we check if the given user is valid
-               $sUser = str_replace(array('%20', '(a)'), array(' ', '@'), $aCommand[1]);
+               $sUser = str_replace(['%20', '(a)'], [' ', '@'], $aCommand[1]);
 
                // Does the hostname match? So we try directly
-               if ($a->get_hostname() == $aCommand[2]) {
+               if ($a->getHostName() == $aCommand[2]) {
                        $this->writeLog(LOG_INFO, 'internal user check for ' . $sUser . '@' . $aCommand[2]);
-                       $found = dba::exists('user', ['nickname' => $sUser]);
+                       $found = DBA::exists('user', ['nickname' => $sUser]);
                } else {
                        $found = false;
                }
@@ -181,17 +177,17 @@ class ExAuth
 
                $url = ($ssl ? 'https' : 'http') . '://' . $host . '/noscrape/' . $user;
 
-               $data = z_fetch_url($url);
+               $curlResult = Network::curl($url);
 
-               if (!is_array($data)) {
+               if (!$curlResult->isSuccess()) {
                        return false;
                }
 
-               if ($data['return_code'] != '200') {
+               if ($curlResult->getReturnCode() != 200) {
                        return false;
                }
 
-               $json = @json_decode($data['body']);
+               $json = @json_decode($curlResult->getBody());
                if (!is_object($json)) {
                        return false;
                }
@@ -206,7 +202,7 @@ class ExAuth
         */
        private function auth(array $aCommand)
        {
-               $a = get_app();
+               $a = \get_app();
 
                // check user authentication
                if (sizeof($aCommand) != 4) {
@@ -220,16 +216,17 @@ class ExAuth
                $this->setHost($aCommand[2]);
 
                // We now check if the password match
-               $sUser = str_replace(array('%20', '(a)'), array(' ', '@'), $aCommand[1]);
+               $sUser = str_replace(['%20', '(a)'], [' ', '@'], $aCommand[1]);
 
                // Does the hostname match? So we try directly
-               if ($a->get_hostname() == $aCommand[2]) {
+               if ($a->getHostName() == $aCommand[2]) {
                        $this->writeLog(LOG_INFO, 'internal auth for ' . $sUser . '@' . $aCommand[2]);
 
-                       $aUser = dba::select('user', ['uid', 'password'], ['nickname' => $sUser], ['limit' => 1]);
-                       if (DBM::is_result($aUser)) {
-                               $uid = User::authenticate($aUser, $aCommand[3]);
-                               $Error = $uid === false;
+                       $aUser = DBA::selectFirst('user', ['uid', 'password', 'legacy_password'], ['nickname' => $sUser]);
+                       if (DBA::isResult($aUser)) {
+                               $uid = $aUser['uid'];
+                               $success = User::authenticate($aUser, $aCommand[3]);
+                               $Error = $success === false;
                        } else {
                                $this->writeLog(LOG_WARNING, 'user not found: ' . $sUser);
                                $Error = true;
@@ -270,7 +267,9 @@ class ExAuth
         */
        private function checkCredentials($host, $user, $password, $ssl)
        {
-               $url = ($ssl ? 'https' : 'http') . '://' . $host . '/api/account/verify_credentials.json';
+               $this->writeLog(LOG_INFO, 'external credential check for ' . $user . '@' . $host);
+
+               $url = ($ssl ? 'https' : 'http') . '://' . $host . '/api/account/verify_credentials.json?skip_status=true';
 
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, $url);
@@ -308,24 +307,25 @@ class ExAuth
 
                $lockpath = Config::get('jabber', 'lockpath');
                if (is_null($lockpath)) {
+                       $this->writeLog(LOG_INFO, 'No lockpath defined.');
                        return;
                }
 
-               $this->pidfile = new Pidfile($lockpath, $host);
-               if ($this->pidfile->isRunning()) {
-                       $oldpid = $this->pidfile->pid();
-                       $this->writeLog(LOG_INFO, 'Process ' . $oldpid . ' was running for ' . $this->pidfile->runningTime() . ' seconds and will now be killed');
-                       $this->pidfile->kill();
-
-                       // Wait until the other process is hopefully killed
-                       sleep(2);
-
-                       $this->pidfile = new Pidfile($lockpath, $host);
-                       if ($oldpid == $this->pidfile->pid()) {
-                               $this->writeLog(LOG_ERR, 'Process ' . $oldpid . "wasn't killed in time. We now quit our process.");
+               $file = $lockpath . DIRECTORY_SEPARATOR . $host;
+               if (PidFile::isRunningProcess($file)) {
+                       if (PidFile::killProcess($file)) {
+                               $this->writeLog(LOG_INFO, 'Old process was successfully killed');
+                       } else {
+                               $this->writeLog(LOG_ERR, "The old Process wasn't killed in time. We now quit our process.");
                                die();
                        }
                }
+
+               // Now it is safe to create the pid file
+               PidFile::create($file);
+               if (!file_exists($file)) {
+                       $this->writeLog(LOG_WARNING, 'Logfile ' . $file . " couldn't be created.");
+               }
        }
 
        /**