X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=lib%2Fapiauth.php;h=cf7a2692ca00b51feb12e547331b3cd29fa4d4fe;hb=0caebc93084b160987239f34b25acadd3aff1fa4;hp=262f4b966c6cb0d64dc5edf1046c1c17c63a445d;hpb=c14ac57b1935a124dd4205e0f02d939086b5867e;p=quix0rs-gnu-social.git

diff --git a/lib/apiauth.php b/lib/apiauth.php
index 262f4b966c..cf7a2692ca 100644
--- a/lib/apiauth.php
+++ b/lib/apiauth.php
@@ -30,15 +30,33 @@
  * @author    Sarven Capadisli <csarven@status.net>
  * @author    Zach Copley <zach@status.net>
  * @copyright 2009-2010 StatusNet, Inc.
+ * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
 
+/* External API usage documentation. Please update when you change how this method works. */
+
+/*! @page authentication Authentication
+
+    StatusNet supports HTTP Basic Authentication and OAuth for API calls.
+
+    @warning Currently, users who have created accounts without setting a
+    password via OpenID, Facebook Connect, etc., cannot use the API until
+    they set a password with their account settings panel.
+
+    @section HTTP Basic Auth
+
+
+
+    @section OAuth
+
+*/
+
 if (!defined('STATUSNET')) {
     exit(1);
 }
 
-require_once INSTALLDIR . '/lib/api.php';
 require_once INSTALLDIR . '/lib/apioauth.php';
 
 /**
@@ -73,29 +91,25 @@ class ApiAuthAction extends ApiAction
         // NOTE: $this->auth_user has to get set in prepare(), not handle(),
         // because subclasses do stuff with it in their prepares.
 
-        if ($this->requiresAuth()) {
-
-            $oauthReq = $this->getOAuthRequest();
+        $oauthReq = $this->getOAuthRequest();
 
-            if (!$oauthReq) {
+        if (!$oauthReq) {
+            if ($this->requiresAuth()) {
                 $this->checkBasicAuthUser(true);
             } else {
-                $this->checkOAuthRequest($oauthReq);
+                // Check to see if a basic auth user is there even
+                // if one's not required
+                $this->checkBasicAuthUser(false);
             }
         } else {
-
-            // Check to see if a basic auth user is there even
-            // if one's not required
-            $this->checkBasicAuthUser(false);
+            $this->checkOAuthRequest($oauthReq);
         }
 
         // Reject API calls with the wrong access level
 
         if ($this->isReadOnly($args) == false) {
-
-            common_debug(get_class($this) . ' is not read-only!');
-
             if ($this->access != self::READ_WRITE) {
+                // TRANS: Client error 401.
                 $msg = _('API resource requires read-write access, ' .
                          'but you only have read access.');
                 $this->clientError($msg, 401, $this->format);
@@ -111,7 +125,6 @@ class ApiAuthAction extends ApiAction
      * This is to avoid doign any unnecessary DB lookups.
      *
      * @return mixed the OAuthRequest or false
-     *
      */
 
     function getOAuthRequest()
@@ -140,7 +153,6 @@ class ApiAuthAction extends ApiAction
      * @param OAuthRequest $request the OAuth Request
      *
      * @return nothing
-     *
      */
 
     function checkOAuthRequest($request)
@@ -169,7 +181,7 @@ class ApiAuthAction extends ApiAction
 
             // set the source attr
 
-            $this->oauth_source = $app->name;
+            $this->source = $app->name;
 
             $appUser = Oauth_application_user::staticGet('token', $access_token);
 
@@ -215,7 +227,7 @@ class ApiAuthAction extends ApiAction
 
         } catch (OAuthException $e) {
             common_log(LOG_WARNING, 'API OAuthException - ' . $e->getMessage());
-            $this->showAuthError();
+            $this->clientError($e->getMessage(), 401, $this->format);
             exit;
         }
     }
@@ -242,14 +254,18 @@ class ApiAuthAction extends ApiAction
     {
         $this->basicAuthProcessHeader();
 
-        $realm = common_config('site', 'name') . ' API';
+        $realm = common_config('api', 'realm');
 
-        if (!isset($this->auth_user_nickname) && $required) {
+        if (empty($realm)) {
+            $realm = common_config('site', 'name') . ' API';
+        }
+
+        if (empty($this->auth_user_nickname) && $required) {
             header('WWW-Authenticate: Basic realm="' . $realm . '"');
 
             // show error if the user clicks 'cancel'
 
-            $this->showAuthError();
+            $this->clientError("Could not authenticate you.", 401, $this->format);
             exit;
 
         } else {
@@ -270,19 +286,19 @@ class ApiAuthAction extends ApiAction
 
             $this->access = self::READ_WRITE;
 
-            if (empty($this->auth_user) && $required) {
+            if (empty($this->auth_user) && ($required || isset($_SERVER['PHP_AUTH_USER']))) {
 
                 // basic authentication failed
 
                 list($proxy, $ip) = common_client_ip();
 
-                $msg = sprintf(_('Failed API auth attempt, nickname = %1$s, ' .
-                         'proxy = %2$s, ip = %3$s'),
+                $msg = sprintf( 'Failed API auth attempt, nickname = %1$s, ' .
+                         'proxy = %2$s, ip = %3$s',
                                $this->auth_user_nickname,
                                $proxy,
                                $ip);
                 common_log(LOG_WARNING, $msg);
-                $this->showAuthError();
+                $this->clientError("Could not authenticate you.", 401, $this->format);
                 exit;
             }
         }
@@ -297,11 +313,15 @@ class ApiAuthAction extends ApiAction
 
     function basicAuthProcessHeader()
     {
-        if (isset($_SERVER['AUTHORIZATION'])
-            || isset($_SERVER['HTTP_AUTHORIZATION'])
-            ) {
-            $authorization_header = isset($_SERVER['HTTP_AUTHORIZATION'])
-              ? $_SERVER['HTTP_AUTHORIZATION'] : $_SERVER['AUTHORIZATION'];
+        $authHeaders = array('AUTHORIZATION',
+                             'HTTP_AUTHORIZATION',
+                             'REDIRECT_HTTP_AUTHORIZATION'); // rewrite for CGI
+        $authorization_header = null;
+        foreach ($authHeaders as $header) {
+            if (isset($_SERVER[$header])) {
+                $authorization_header = $_SERVER[$header];
+                break;
+            }
         }
 
         if (isset($_SERVER['PHP_AUTH_USER'])) {
@@ -325,36 +345,4 @@ class ApiAuthAction extends ApiAction
             }
         }
     }
-
-    /**
-     * Output an authentication error message.  Use XML or JSON if one
-     * of those formats is specified, otherwise output plain text
-     *
-     * @return void
-     */
-
-    function showAuthError()
-    {
-        header('HTTP/1.1 401 Unauthorized');
-        $msg = 'Could not authenticate you.';
-
-        if ($this->format == 'xml') {
-            header('Content-Type: application/xml; charset=utf-8');
-            $this->startXML();
-            $this->elementStart('hash');
-            $this->element('error', null, $msg);
-            $this->element('request', null, $_SERVER['REQUEST_URI']);
-            $this->elementEnd('hash');
-            $this->endXML();
-        } elseif ($this->format == 'json') {
-            header('Content-Type: application/json; charset=utf-8');
-            $error_array = array('error' => $msg,
-                                 'request' => $_SERVER['REQUEST_URI']);
-            print(json_encode($error_array));
-        } else {
-            header('Content-type: text/plain');
-            print "$msg\n";
-        }
-    }
-
 }