X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=src%2FModule%2FMagic.php;h=f6f3bbc5908120dd06ec1fcf9ed67fb8cc94701e;hb=6dbbd081795fa1c8fe57db2248ac162efeeada88;hp=1b364a33194ea067d6254ab2257a61d080c412a4;hpb=9195ea26b1551c57f5686547954db6a8b03d61b9;p=friendica.git diff --git a/src/Module/Magic.php b/src/Module/Magic.php index 1b364a3319..f6f3bbc590 100644 --- a/src/Module/Magic.php +++ b/src/Module/Magic.php @@ -1,126 +1,141 @@ . + * */ + namespace Friendica\Module; +use Friendica\App; use Friendica\BaseModule; -use Friendica\Database\DBM; -use Friendica\Network\Probe; -use Friendica\Util\HTTPSig; -use Friendica\Util\Network; - -use dba; +use Friendica\Core\L10n; +use Friendica\Core\System; +use Friendica\Database\Database; +use Friendica\Model\Contact; +use Friendica\Model\User; +use Friendica\Network\HTTPClient\Capability\ICanSendHttpRequests; +use Friendica\Network\HTTPClient\Client\HttpClientOptions; +use Friendica\Util\HTTPSignature; +use Friendica\Util\Profiler; +use Friendica\Util\Strings; +use Psr\Log\LoggerInterface; /** * Magic Auth (remote authentication) module. - * + * * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/Zotlabs/Module/Magic.php */ class Magic extends BaseModule { - public static function init() + /** @var App */ + protected $app; + /** @var Database */ + protected $dba; + /** @var ICanSendHttpRequests */ + protected $httpClient; + + public function __construct(App $app, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, Database $dba, ICanSendHttpRequests $httpClient, array $server, array $parameters = []) { - $a = self::getApp(); - $ret = ['success' => false, 'url' => '', 'message' => '']; - logger('magic mdule: invoked', LOGGER_DEBUG); - - logger('args: ' . print_r($_REQUEST, true), LOGGER_DATA); - - $addr = ((x($_REQUEST, 'addr')) ? $_REQUEST['addr'] : ''); - $dest = ((x($_REQUEST, 'dest')) ? $_REQUEST['dest'] : ''); - $test = ((x($_REQUEST, 'test')) ? intval($_REQUEST['test']) : 0); - $owa = ((x($_REQUEST, 'owa')) ? intval($_REQUEST['owa']) : 0); - - // NOTE: I guess $dest isn't just the profile url (could be also - // other profile pages e.g. photo). We need to find a solution - // to be able to redirct to other pages than the contact profile. - $fields = ["id", "nurl", "url"]; - $condition = ["nurl" => normalise_link($dest)]; - - $contact = dba::selectFirst("contact", $fields, $condition); - - if (!DBM::is_result($contact)) { - // If we don't have a contact record, try to probe it. - /// @todo: Also check against the $addr. - Probe::uri($dest, '', -1, true, true); - $contact = dba::selectFirst("contact", $fields, $condition); + parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters); + + $this->app = $app; + $this->dba = $dba; + $this->httpClient = $httpClient; + } + + protected function rawContent(array $request = []) + { + $this->logger->info('magic module: invoked'); + + $this->logger->debug('args', ['request' => $_REQUEST]); + + $addr = $_REQUEST['addr'] ?? ''; + $dest = $_REQUEST['dest'] ?? ''; + $owa = (!empty($_REQUEST['owa']) ? intval($_REQUEST['owa']) : 0); + $cid = 0; + + if (!empty($addr)) { + $cid = Contact::getIdForURL($addr); + } elseif (!empty($dest)) { + $cid = Contact::getIdForURL($dest); } - if (!DBM::is_result($contact)) { - logger("No contact record found: " . print_r($_REQUEST, true), LOGGER_DEBUG); - goaway($dest); + if (!$cid) { + $this->logger->info('No contact record found', $_REQUEST); + // @TODO Finding a more elegant possibility to redirect to either internal or external URL + $this->app->redirect($dest); } + $contact = $this->dba->selectFirst('contact', ['id', 'nurl', 'url'], ['id' => $cid]); // Redirect if the contact is already authenticated on this site. - if (array_key_exists("id", $a->contact) && strpos($contact['nurl'], normalise_link(self::getApp()->get_baseurl())) !== false) { - if($test) { - $ret['success'] = true; - $ret['message'] .= 'Local site - you are already authenticated.' . EOL; - return $ret; - } - - logger("Contact is already authenticated", LOGGER_DEBUG); - goaway($dest); + if ($this->app->getContactId() && strpos($contact['nurl'], Strings::normaliseLink($this->baseUrl->get())) !== false) { + $this->logger->info('Contact is already authenticated'); + System::externalRedirect($dest); } - if (local_user()) { - $user = $a->user; - - // OpenWebAuth - if ($owa) { - // Extract the basepath - // NOTE: we need another solution because this does only work - // for friendica contacts :-/ . We should have the basepath - // of a contact also in the contact table. - $exp = explode("/profile/", $contact['url']); - $basepath = $exp[0]; - - $headers = []; - $headers['Accept'] = 'application/x-dfrn+json'; - $headers['X-Open-Web-Auth'] = random_string(); - - // Create a header that is signed with the local users private key. - $headers = HTTPSig::createSig( - '', - $headers, - $user['prvkey'], - 'acct:' . $user['nickname'] . '@' . $a->get_hostname() . ($a->path ? '/' . $a->path : ''), - false, - true, - 'sha512' - ); - - // Try to get an authentication token from the other instance. - $x = Network::curl($basepath . '/owa', false, $redirects, ['headers' => $headers]); - - if ($x['success']) { - $j = json_decode($x['body'], true); - - if ($j['success']) { - $token = ''; - if ($j['encrypted_token']) { - // The token is encrypted. If the local user is really the one the other instance - // thinks he/she is, the token can be decrypted with the local users public key. - openssl_private_decrypt(base64url_decode($j['encrypted_token']), $token, $user['prvkey']); - } else { - $token = $j['token']; - } - $x = strpbrk($dest, '?&'); - $args = (($x) ? '&owt=' . $token : '?f=&owt=' . $token); - - goaway($dest . $args); + // OpenWebAuth + if (local_user() && $owa) { + $user = User::getById(local_user()); + + // Extract the basepath + // NOTE: we need another solution because this does only work + // for friendica contacts :-/ . We should have the basepath + // of a contact also in the contact table. + $exp = explode('/profile/', $contact['url']); + $basepath = $exp[0]; + + $header = [ + 'Accept' => ['application/x-dfrn+json', 'application/x-zot+json'], + 'X-Open-Web-Auth' => [Strings::getRandomHex()], + ]; + + // Create a header that is signed with the local users private key. + $header = HTTPSignature::createSig( + $header, + $user['prvkey'], + 'acct:' . $user['nickname'] . '@' . $this->baseUrl->getHostname() . ($this->baseUrl->getUrlPath() ? '/' . $this->baseUrl->getUrlPath() : '') + ); + + // Try to get an authentication token from the other instance. + $curlResult = $this->httpClient->get($basepath . '/owa', [HttpClientOptions::HEADERS => $header]); + + if ($curlResult->isSuccess()) { + $j = json_decode($curlResult->getBody(), true); + + if ($j['success']) { + $token = ''; + if ($j['encrypted_token']) { + // The token is encrypted. If the local user is really the one the other instance + // thinks he/she is, the token can be decrypted with the local users public key. + openssl_private_decrypt(Strings::base64UrlDecode($j['encrypted_token']), $token, $user['prvkey']); + } else { + $token = $j['token']; } + $args = (strpbrk($dest, '?&') ? '&' : '?') . 'owt=' . $token; + + $this->logger->info('Redirecting', ['path' => $dest . $args]); + System::externalRedirect($dest . $args); } - goaway($dest); } + System::externalRedirect($dest); } - if($test) { - $ret['message'] = 'Not authenticated or invalid arguments' . EOL; - return $ret; - } - - goaway($dest); + // @TODO Finding a more elegant possibility to redirect to either internal or external URL + $this->app->redirect($dest); } }