Allow re-authentication with OpenID

"Rememberme" logins aren't allowed to make changes to an account
(since cookie-stealing is too easy). Users have to re-authenticate.
Previously, it was impossible to do so without having a username and
password; this change lets you do it with OpenID, too.

diff --git a/actions/finishopenidlogin.php b/actions/finishopenidlogin.php
index 880a9505b4c07d7294bb64961018183c84fd3fd0..bc91511207653fd2e0ad1fa910afeba632ece3ae 100644 (file)
--- a/actions/finishopenidlogin.php
+++ b/actions/finishopenidlogin.php
@@ -30,7 +30,7 @@ class FinishopenidloginAction extends Action
     function handle($args)
     {
         parent::handle($args);
-        if (common_logged_in()) {
+        if (common_is_real_login()) {
             $this->clientError(_('Already logged in.'));
         } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $token = $this->trimmed('token');

diff --git a/actions/openidlogin.php b/actions/openidlogin.php
index 7a267a2bdc00829dbe1ac4a444bcf9dbdd67dda7..1a4372d73e76722dfe5f60d30b220b6ba191b3f0 100644 (file)
--- a/actions/openidlogin.php
+++ b/actions/openidlogin.php
@@ -26,7 +26,7 @@ class OpenidloginAction extends Action
     function handle($args)
     {
         parent::handle($args);
-        if (common_logged_in()) {
+        if (common_is_real_login()) {
             $this->clientError(_('Already logged in.'));
         } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $openid_url = $this->trimmed('openid_url');
@@ -59,7 +59,16 @@ class OpenidloginAction extends Action
 
     function getInstructions()
     {
-        return _('Login with an [OpenID](%%doc.openid%%) account.');
+        if (common_logged_in() && !common_is_real_login() &&
+            common_get_returnto()) {
+            // rememberme logins have to reauthenticate before
+            // changing any profile settings (cookie-stealing protection)
+            return _('For security reasons, please re-login with your ' .
+                     '[OpenID](%%doc.openid%%) ' .
+                     'before changing your settings.');
+        } else {
+            return _('Login with an [OpenID](%%doc.openid%%) account.');
+        }
     }
 
     function showPageNotice()

diff --git a/classes/User.php b/classes/User.php
index b1c061c18fb096f59c43115813b7a6505ae0516f..a6a1b11b9f502d7a6a27d155ce840eb92154a0ae 100644 (file)
--- a/classes/User.php
+++ b/classes/User.php
@@ -630,4 +630,15 @@ class User extends Memcached_DataObject
 
         return $profile;
     }
+
+    function hasOpenID()
+    {
+        $oid = new User_openid();
+
+        $oid->user_id = $this->id;
+
+        $cnt = $oid->find();
+
+        return ($cnt > 0);
+    }
 }

diff --git a/lib/settingsaction.php b/lib/settingsaction.php
index dfe1f114b21e1b73dc10b36692a1b144e4db27e8..53c807c6f9cc834aaa6955d6107e8e11a5811742 100644 (file)
--- a/lib/settingsaction.php
+++ b/lib/settingsaction.php
@@ -76,7 +76,12 @@ class SettingsAction extends Action
             // change important settings or see private info, and
             // _all_ our settings are important
             common_set_returnto($this->selfUrl());
-            common_redirect(common_local_url('login'));
+            $user = common_current_user();
+            if ($user->hasOpenID()) {
+                common_redirect(common_local_url('openidlogin'));
+            } else {
+                common_redirect(common_local_url('login'));
+            }
         } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $this->handlePost();
         } else {