X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=actions%2Fapioauthauthorize.php;h=e7c6f376116d636bdd42c05d55ecb6b00c306739;hb=b2e8d8407cc7f1abb5e8767cd3403ac356775eaa;hp=48d5087efc30388a55b1c363ef9c46aceebf090b;hpb=e7f4ab677480f0fa39db5199de5f77821ba4a60d;p=quix0rs-gnu-social.git
diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index 48d5087efc..e7c6f37611 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -31,7 +31,7 @@ if (!defined('STATUSNET')) {
exit(1);
}
-require_once INSTALLDIR . '/lib/apioauthstore.php';
+require_once INSTALLDIR . '/lib/apioauth.php';
/**
* Authorize an OAuth request token
@@ -43,7 +43,7 @@ require_once INSTALLDIR . '/lib/apioauthstore.php';
* @link http://status.net/
*/
-class ApiOauthAuthorizeAction extends Action
+class ApiOauthAuthorizeAction extends ApiOauthAction
{
var $oauth_token;
var $callback;
@@ -67,49 +67,16 @@ class ApiOauthAuthorizeAction extends Action
{
parent::prepare($args);
- common_debug(var_export($_REQUEST, true));
-
$this->nickname = $this->trimmed('nickname');
$this->password = $this->arg('password');
$this->oauth_token = $this->arg('oauth_token');
$this->callback = $this->arg('oauth_callback');
$this->store = new ApiStatusNetOAuthDataStore();
+ $this->app = $this->store->getAppByRequestToken($this->oauth_token);
return true;
}
- function getApp()
- {
- // Look up the full req token
-
- $req_token = $this->store->lookup_token(null,
- 'request',
- $this->oauth_token);
-
- if (empty($req_token)) {
-
- common_debug("Couldn't find request token!");
-
- $this->clientError(_('Bad request.'));
- return;
- }
-
- // Look up the app
-
- $app = new Oauth_application();
- $app->consumer_key = $req_token->consumer_key;
- $result = $app->find(true);
-
- if (!empty($result)) {
- $this->app = $app;
- return true;
-
- } else {
- common_debug("couldn't find the app!");
- return false;
- }
- }
-
/**
* Handle input, produce output
*
@@ -130,22 +97,17 @@ class ApiOauthAuthorizeAction extends Action
} else {
- // XXX: make better error messages
-
if (empty($this->oauth_token)) {
-
- common_debug("No request token found.");
-
- $this->clientError(_('Bad request.'));
+ $this->clientError(_('No oauth_token parameter provided.'));
return;
}
- if (!$this->getApp()) {
- $this->clientError(_('Bad request.'));
+ if (empty($this->app)) {
+ $this->clientError(_('Invalid token.'));
return;
}
- common_debug("Requesting auth for app: $app->name.");
+ $name = $this->app->name;
$this->showForm();
}
@@ -163,14 +125,9 @@ class ApiOauthAuthorizeAction extends Action
return;
}
- if (!$this->getApp()) {
- $this->clientError(_('Bad request.'));
- return;
- }
-
// check creds
- $user = null;
+ $user = null;
if (!common_logged_in()) {
$user = common_check_user($this->nickname, $this->password);
@@ -179,64 +136,80 @@ class ApiOauthAuthorizeAction extends Action
return;
}
} else {
- $user = common_current_user();
- }
+ $user = common_current_user();
+ }
if ($this->arg('allow')) {
- // mark the req token as authorized
+ // mark the req token as authorized
$this->store->authorize_token($this->oauth_token);
- // Check to see if there was a previous token associated
- // with this user/app and kill it. If you're doing this you
- // probably don't want any old tokens anyway.
+ // Check to see if there was a previous token associated
+ // with this user/app and kill it. If the user is doing this she
+ // probably doesn't want any old tokens anyway.
- $appUser = Oauth_application_user::getByKeys($user, $this->app);
+ $appUser = Oauth_application_user::getByKeys($user, $this->app);
- if (!empty($appUser)) {
- $result = $appUser->delete();
+ if (!empty($appUser)) {
+ $result = $appUser->delete();
- if (!$result) {
- common_log_db_error($appUser, 'DELETE', __FILE__);
- throw new ServerException(_('DB error deleting OAuth app user.'));
- return;
- }
- }
+ if (!$result) {
+ common_log_db_error($appUser, 'DELETE', __FILE__);
+ throw new ServerException(_('Database error deleting OAuth application user.'));
+ return;
+ }
+ }
+
+ // associated the authorized req token with the user and the app
- // associated the new req token with the user and the app
+ $appUser = new Oauth_application_user();
- $appUser = new Oauth_application_user();
+ $appUser->profile_id = $user->id;
+ $appUser->application_id = $this->app->id;
- $appUser->profile_id = $user->id;
- $appUser->application_id = $this->app->id;
- $appUser->access_type = $this->app->access_type;
- $appUser->token = $this->oauth_token;
- $appUser->created = common_sql_now();
+ // Note: do not copy the access type from the application.
+ // The access type should always be 0 when the OAuth app
+ // user record has a request token associated with it.
+ // Access type gets assigned once an access token has been
+ // granted. The OAuth app user record then gets updated
+ // with the new access token and access type.
- $result = $appUser->insert();
+ $appUser->token = $this->oauth_token;
+ $appUser->created = common_sql_now();
- if (!$result) {
- common_log_db_error($appUser, 'INSERT', __FILE__);
- throw new ServerException(_('DB error inserting OAuth app user.'));
- return;
- }
+ $result = $appUser->insert();
+
+ if (!$result) {
+ common_log_db_error($appUser, 'INSERT', __FILE__);
+ throw new ServerException(_('Database error inserting OAuth application user.'));
+ return;
+ }
// if we have a callback redirect and provide the token
+ // A callback specified in the app setup overrides whatever
+ // is passed in with the request.
+
+ if (!empty($this->app->callback_url)) {
+ $this->callback = $this->app->callback_url;
+ }
+
if (!empty($this->callback)) {
- // XXX: Need better way to build this redirect url.
+ $target_url = $this->getCallback($this->callback,
+ array('oauth_token' => $this->oauth_token));
- $target_url = $this->callback . '?oauth_token=' . $this->oauth_token;
common_redirect($target_url, 303);
+ } else {
+ common_debug("callback was empty!");
}
// otherwise inform the user that the rt was authorized
$this->elementStart('p');
- // XXX: Do OAuth 1.0a verifier code?
+ // XXX: Do OAuth 1.0a verifier code
$this->raw(sprintf(_("The request token %s has been authorized. " .
'Please exchange it for an access token.'),
@@ -246,9 +219,12 @@ class ApiOauthAuthorizeAction extends Action
} else if ($this->arg('deny')) {
+ $datastore = new ApiStatusNetOAuthDataStore();
+ $datastore->revoke_token($this->oauth_token, 0);
+
$this->elementStart('p');
- $this->raw(sprintf(_("The request token %s has been denied."),
+ $this->raw(sprintf(_("The request token %s has been denied and revoked."),
$this->oauth_token));
$this->elementEnd('p');
@@ -267,9 +243,9 @@ class ApiOauthAuthorizeAction extends Action
function showScripts()
{
parent::showScripts();
- if (!common_logged_in()) {
- $this->autofocus('nickname');
- }
+ if (!common_logged_in()) {
+ $this->autofocus('nickname');
+ }
}
/**
@@ -283,27 +259,6 @@ class ApiOauthAuthorizeAction extends Action
return _('An application would like to connect to your account');
}
- /**
- * Show page notice
- *
- * Display a notice for how to use the page, or the
- * error if it exists.
- *
- * @return void
- */
-
- function showPageNotice()
- {
- if ($this->error) {
- $this->element('p', 'error', $this->error);
- } else {
- $instr = $this->getInstructions();
- $output = common_markup_to_html($instr);
-
- $this->raw($output);
- }
- }
-
/**
* Shows the authorization form.
*
@@ -313,44 +268,46 @@ class ApiOauthAuthorizeAction extends Action
function showContent()
{
$this->elementStart('form', array('method' => 'post',
- 'id' => 'form_login',
- 'class' => 'form_settings',
- 'action' => common_local_url('apioauthauthorize')));
+ 'id' => 'form_apioauthauthorize',
+ 'class' => 'form_settings',
+ 'action' => common_local_url('apioauthauthorize')));
+ $this->elementStart('fieldset');
+ $this->element('legend', array('id' => 'apioauthauthorize_allowdeny'),
+ _('Allow or deny access'));
$this->hidden('token', common_session_token());
$this->hidden('oauth_token', $this->oauth_token);
$this->hidden('oauth_callback', $this->callback);
- $this->elementStart('fieldset');
-
- $this->elementStart('ul');
+ $this->elementStart('ul', 'form_data');
$this->elementStart('li');
+ $this->elementStart('p');
if (!empty($this->app->icon)) {
$this->element('img', array('src' => $this->app->icon));
}
- $this->elementEnd('li');
- $this->elementStart('li');
$access = ($this->app->access_type & Oauth_application::$writeAccess) ?
'access and update' : 'access';
- $msg = _("The application %s by %s would like " .
- "the ability to %s your account data.");
+ $msg = _('The application %1$s by ' .
+ '%2$s would like the ability ' .
+ 'to %3$s your %4$s account data. ' .
+ 'You should only give access to your %4$s account ' .
+ 'to third parties you trust.');
$this->raw(sprintf($msg,
$this->app->name,
$this->app->organization,
- $access));
-
+ $access,
+ common_config('site', 'name')));
+ $this->elementEnd('p');
$this->elementEnd('li');
$this->elementEnd('ul');
- $this->elementEnd('fieldset');
-
if (!common_logged_in()) {
$this->elementStart('fieldset');
- $this->element('legend', null, _('Login'));
+ $this->element('legend', null, _('Account'));
$this->elementStart('ul', 'form_data');
$this->elementStart('li');
$this->input('nickname', _('Nickname'));
@@ -365,17 +322,18 @@ class ApiOauthAuthorizeAction extends Action
}
$this->element('input', array('id' => 'deny_submit',
- 'class' => 'submit',
+ 'class' => 'submit submit form_action-primary',
'name' => 'deny',
'type' => 'submit',
'value' => _('Deny')));
$this->element('input', array('id' => 'allow_submit',
- 'class' => 'submit',
+ 'class' => 'submit submit form_action-secondary',
'name' => 'allow',
'type' => 'submit',
'value' => _('Allow')));
+ $this->elementEnd('fieldset');
$this->elementEnd('form');
}
@@ -391,7 +349,6 @@ class ApiOauthAuthorizeAction extends Action
function getInstructions()
{
return _('Allow or deny access to your account information.');
-
}
/**
@@ -404,6 +361,31 @@ class ApiOauthAuthorizeAction extends Action
function showLocalNav()
{
+ // NOP
+ }
+
+ /**
+ * Show site notice.
+ *
+ * @return nothing
+ */
+
+ function showSiteNotice()
+ {
+ // NOP
+ }
+
+ /**
+ * Show notice form.
+ *
+ * Show the form for posting a new notice
+ *
+ * @return nothing
+ */
+
+ function showNoticeForm()
+ {
+ // NOP
}
}