* @category Plugin
* @package StatusNet
* @author Evan Prodromou <evan@status.net>
- * @copyright 2009 StatusNet, Inc.
+ * @copyright 2009-2010 StatusNet, Inc.
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
* @link http://status.net/
*/
class OpenIDPlugin extends Plugin
{
- public $openidOnly = false;
+ // Plugin parameter: set true to disallow non-OpenID logins
+ // If set, overrides the setting in database or $config['site']['openidonly']
+ public $openidOnly = null;
+
+ function initialize()
+ {
+ parent::initialize();
+ if ($this->openidOnly !== null) {
+ global $config;
+ $config['site']['openidonly'] = (bool)$this->openidOnly;
+ }
+
+ }
/**
* Add OpenID-related paths to the router table
$m->connect('index.php?action=finishaddopenid',
array('action' => 'finishaddopenid'));
$m->connect('main/openidserver', array('action' => 'openidserver'));
+ $m->connect('admin/openid', array('action' => 'openidadminpanel'));
return true;
}
function onStartConnectPath(&$path, &$defaults, &$rules, &$result)
{
- if ($this->openidOnly) {
+ if (common_config('site', 'openidonly')) {
static $block = array('main/login',
'main/register',
'main/recoverpassword',
function onArgsInitialize($args)
{
- if ($this->openidOnly) {
+ if (common_config('site', 'openidonly')) {
if (array_key_exists('action', $args)) {
$action = trim($args['action']);
if (in_array($action, array('login', 'register'))) {
function onStartPrimaryNav($action)
{
- if ($this->openidOnly && !common_logged_in()) {
+ if (common_config('site', 'openidonly') && !common_logged_in()) {
// TRANS: Tooltip for main menu option "Login"
$tooltip = _m('TOOLTIP', 'Login to the site');
// TRANS: Main menu option when not logged in to log in
function onStartLoginGroupNav(&$action)
{
- if ($this->openidOnly) {
+ if (common_config('site', 'openidonly')) {
$this->showOpenIDLoginTab($action);
// Even though we replace this code, we
// DON'T run the End* hook, to keep others from
*/
function onStartAccountSettingsPasswordMenuItem($menu, &$unused) {
- if ($this->openidOnly) {
+ if (common_config('site', 'openidonly')) {
return false;
}
return true;
case 'OpenidsettingsAction':
case 'OpenidserverAction':
case 'OpenidtrustAction':
- require_once INSTALLDIR.'/plugins/OpenID/' . strtolower(mb_substr($cls, 0, -6)) . '.php';
+ case 'OpenidadminpanelAction':
+ require_once dirname(__FILE__) . '/' . strtolower(mb_substr($cls, 0, -6)) . '.php';
return false;
case 'User_openid':
- require_once INSTALLDIR.'/plugins/OpenID/User_openid.php';
+ require_once dirname(__FILE__) . '/User_openid.php';
return false;
case 'User_openid_trustroot':
- require_once INSTALLDIR.'/plugins/OpenID/User_openid_trustroot.php';
+ require_once dirname(__FILE__) . '/User_openid_trustroot.php';
+ return false;
+ case 'Auth_OpenID_TeamsExtension':
+ case 'Auth_OpenID_TeamsRequest':
+ case 'Auth_OpenID_TeamsResponse':
+ require_once dirname(__FILE__) . '/extlib/teams-extension.php';
return false;
default:
return true;
function onRedirectToLogin($action, $user)
{
- if ($this->openidOnly || (!empty($user) && User_openid::hasOpenID($user->id))) {
+ if (common_config('site', 'openid_only') || (!empty($user) && User_openid::hasOpenID($user->id))) {
common_redirect(common_local_url('openidlogin'), 303);
return false;
}
return true;
}
+ /**
+ * Add an OpenID tab to the admin panel
+ *
+ * @param Widget $nav Admin panel nav
+ *
+ * @return boolean hook value
+ */
+
+ function onEndAdminPanelNav($nav)
+ {
+ if (AdminPanelAction::canAdmin('openid')) {
+
+ $action_name = $nav->action->trimmed('action');
+
+ $nav->out->menuItem(
+ common_local_url('openidadminpanel'),
+ _m('OpenID'),
+ _m('OpenID configuration'),
+ $action_name == 'openidadminpanel',
+ 'nav_openid_admin_panel'
+ );
+ }
+
+ return true;
+ }
+
/**
* Add our version information to output
*
--- /dev/null
+team-extension.php
+ Support for Launchpad's OpenID Teams extension
+ Maintainer: Canonical
+ Source: https://code.edge.launchpad.net/wordpress-teams-integration
+ r27 2010-04-27
+ License: AGPLv3
--- /dev/null
+<?php
+/*
+ * Wordpress Teams plugin
+ * Copyright (C) 2009-2010 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * Provides an example OpenID extension to query user team/group membership
+ *
+ * This code is based on code supplied with the openid library for simple
+ * registration data.
+ */
+
+/**
+ * Require the Message implementation.
+ */
+require_once 'Auth/OpenID/Message.php';
+require_once 'Auth/OpenID/Extension.php';
+
+/**
+ * The team/group extension base class
+ */
+class Auth_OpenID_TeamsExtension extends Auth_OpenID_Extension {
+ var $ns_uri = 'http://ns.launchpad.net/2007/openid-teams';
+ var $ns_alias = 'lp';
+ var $request_field = 'query_membership';
+ var $response_field = 'is_member';
+
+ /**
+ * Get the string arguments that should be added to an OpenID
+ * message for this extension.
+ */
+ function getExtensionArgs() {
+ $args = array();
+
+ if ($this->_teams) {
+ $args[$this->request_field] = implode(',', $this->_teams);
+ }
+
+ return $args;
+ }
+
+ /**
+ * Add the arguments from this extension to the provided message.
+ *
+ * Returns the message with the extension arguments added.
+ */
+ function toMessage(&$message) {
+ if ($message->namespaces->addAlias($this->ns_uri, $this->ns_alias) === null) {
+ if ($message->namespaces->getAlias($this->ns_uri) != $this->ns_alias) {
+ return null;
+ }
+ }
+
+ $message->updateArgs($this->ns_uri, $this->getExtensionArgs());
+ return $message;
+ }
+
+ /**
+ * Extract the team/group namespace URI from the given OpenID message.
+ * Handles OpenID 1 and 2.
+ *
+ * $message: The OpenID message from which to parse team/group data.
+ * This may be a request or response message.
+ *
+ * Returns the sreg namespace URI for the supplied message.
+ *
+ * @access private
+ */
+ function _getExtensionNS(&$message) {
+ $alias = null;
+ $found_ns_uri = null;
+
+ // See if there exists an alias for the namespace
+ $alias = $message->namespaces->getAlias($this->ns_uri);
+
+ if ($alias !== null) {
+ $found_ns_uri = $this->ns_uri;
+ }
+
+ if ($alias === null) {
+ // There is no alias for this extension, so try to add one.
+ $found_ns_uri = Auth_OpenID_TYPE_1_0;
+
+ if ($message->namespaces->addAlias($this->ns_uri, $this->ns_alias) === null) {
+ // An alias for the string 'lp' already exists, but
+ // it's defined for something other than team/group membership
+ return null;
+ }
+ }
+
+ return $found_ns_uri;
+ }
+}
+
+/**
+ * The team/group extension request class
+ */
+class Auth_OpenID_TeamsRequest extends Auth_OpenID_TeamsExtension {
+ function __init($teams) {
+ if (!is_array($teams)) {
+ if (!empty($teams)) {
+ $teams = explode(',', $teams);
+ } else {
+ $teams = Array();
+ }
+ }
+
+ $this->_teams = $teams;
+ }
+
+ function Auth_OpenID_TeamsRequest($teams) {
+ $this->__init($teams);
+ }
+}
+
+/**
+ * The team/group extension response class
+ */
+class Auth_OpenID_TeamsResponse extends Auth_OpenID_TeamsExtension {
+ var $_teams = array();
+
+ function __init(&$resp, $signed_only=true) {
+ $this->ns_uri = $this->_getExtensionNS($resp->message);
+
+ if ($signed_only) {
+ $args = $resp->getSignedNS($this->ns_uri);
+ } else {
+ $args = $resp->message->getArgs($this->ns_uri);
+ }
+
+ if ($args === null) {
+ return null;
+ }
+
+ // An OpenID 2.0 response will handle the namespaces
+ if (in_array($this->response_field, array_keys($args)) && !empty($args[$this->response_field])) {
+ $this->_teams = explode(',', $args[$this->response_field]);
+ }
+
+ // Piggybacking on a 1.x request, however, won't so the field name will
+ // be different
+ elseif (in_array($this->ns_alias.'.'.$this->response_field, array_keys($args)) && !empty($args[$this->ns_alias.'.'.$this->response_field])) {
+ $this->_teams = explode(',', $args[$this->ns_alias.'.'.$this->response_field]);
+ }
+ }
+
+ function Auth_OpenID_TeamsResponse(&$resp, $signed_only=true) {
+ $this->__init($resp, $signed_only);
+ }
+
+ /**
+ * Get the array of teams the user is a member of
+ *
+ * @return array
+ */
+ function getTeams() {
+ return $this->_teams;
+ }
+}
+
+?>
$sreg = $sreg_resp->contents();
}
+ // Launchpad teams extension
+ if (!oid_check_teams($response)) {
+ $this->message(_m('OpenID authentication aborted: you are not allowed to login to this site.'));
+ return;
+ }
+
$cur = common_current_user();
$other = oid_get_user($canonical);
$sreg = $sreg_resp->contents();
}
+ // Launchpad teams extension
+ if (!oid_check_teams($response)) {
+ $this->message(_m('OpenID authentication aborted: you are not allowed to login to this site.'));
+ return;
+ }
+
$user = oid_get_user($canonical);
if ($user) {
$auth_request->addExtension($sreg_request);
}
+ $requiredTeam = common_config('openid', 'required_team');
+ if ($requiredTeam) {
+ // LaunchPad OpenID extension
+ $team_request = new Auth_OpenID_TeamsRequest(array($requiredTeam));
+ if ($team_request) {
+ $auth_request->addExtension($team_request);
+ }
+ }
+
$trust_root = common_root_url(true);
$process_url = common_local_url($returnto);
return;
}
+/**
+ * Check the teams available in the given OpenID response
+ * Using Launchpad's OpenID teams extension
+ *
+ * @return boolean whether this user is acceptable
+ */
+function oid_check_teams($response)
+{
+ $requiredTeam = common_config('openid', 'required_team');
+ if ($requiredTeam) {
+ $team_resp = new Auth_OpenID_TeamsResponse($response);
+ if ($team_resp) {
+ $teams = $team_resp->getTeams();
+ } else {
+ $teams = array();
+ }
+
+ $match = in_array($requiredTeam, $teams);
+ $is = $match ? 'is' : 'is not';
+ common_log(LOG_DEBUG, "Remote user $is in required team $requiredTeam: [" . implode(', ', $teams) . "]");
+
+ return $match;
+ }
+
+ return true;
+}
+
class AutosubmitAction extends Action
{
var $form_html = null;
--- /dev/null
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * OpenID bridge administration panel
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category Settings
+ * @package StatusNet
+ * @author Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+ exit(1);
+}
+
+/**
+ * Administer global OpenID settings
+ *
+ * @category Admin
+ * @package StatusNet
+ * @author Zach Copley <zach@status.net>
+ * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link http://status.net/
+ */
+
+class OpenidadminpanelAction extends AdminPanelAction
+{
+ /**
+ * Returns the page title
+ *
+ * @return string page title
+ */
+
+ function title()
+ {
+ return _m('OpenID');
+ }
+
+ /**
+ * Instructions for using this form.
+ *
+ * @return string instructions
+ */
+
+ function getInstructions()
+ {
+ return _m('OpenID settings');
+ }
+
+ /**
+ * Show the OpenID admin panel form
+ *
+ * @return void
+ */
+
+ function showForm()
+ {
+ $form = new OpenIDAdminPanelForm($this);
+ $form->show();
+ return;
+ }
+
+ /**
+ * Save settings from the form
+ *
+ * @return void
+ */
+
+ function saveSettings()
+ {
+ static $settings = array(
+ 'openid' => array('trusted_provider', 'required_team')
+ );
+
+ static $booleans = array(
+ 'site' => array('openidonly')
+ );
+
+ $values = array();
+
+ foreach ($settings as $section => $parts) {
+ foreach ($parts as $setting) {
+ $values[$section][$setting]
+ = $this->trimmed($setting);
+ }
+ }
+
+ foreach ($booleans as $section => $parts) {
+ foreach ($parts as $setting) {
+ $values[$section][$setting]
+ = ($this->boolean($setting)) ? 1 : 0;
+ }
+ }
+
+ // This throws an exception on validation errors
+
+ $this->validate($values);
+
+ // assert(all values are valid);
+
+ $config = new Config();
+
+ $config->query('BEGIN');
+
+ foreach ($settings as $section => $parts) {
+ foreach ($parts as $setting) {
+ Config::save($section, $setting, $values[$section][$setting]);
+ }
+ }
+
+ foreach ($booleans as $section => $parts) {
+ foreach ($parts as $setting) {
+ Config::save($section, $setting, $values[$section][$setting]);
+ }
+ }
+
+ $config->query('COMMIT');
+
+ return;
+ }
+
+ function validate(&$values)
+ {
+ // Validate consumer key and secret (can't be too long)
+
+ if (mb_strlen($values['openid']['trusted_provider']) > 255) {
+ $this->clientError(
+ _m("Invalid provider URL. Max length is 255 characters.")
+ );
+ }
+
+ if (mb_strlen($values['openid']['required_team']) > 255) {
+ $this->clientError(
+ _m("Invalid team name. Max length is 255 characters.")
+ );
+ }
+ }
+}
+
+class OpenIDAdminPanelForm extends AdminForm
+{
+ /**
+ * ID of the form
+ *
+ * @return int ID of the form
+ */
+
+ function id()
+ {
+ return 'openidadminpanel';
+ }
+
+ /**
+ * class of the form
+ *
+ * @return string class of the form
+ */
+
+ function formClass()
+ {
+ return 'form_settings';
+ }
+
+ /**
+ * Action of the form
+ *
+ * @return string URL of the action
+ */
+
+ function action()
+ {
+ return common_local_url('openidadminpanel');
+ }
+
+ /**
+ * Data elements of the form
+ *
+ * @return void
+ *
+ * @todo Some of the options could prevent users from logging in again.
+ * Make sure that the acting administrator has a valid OpenID matching,
+ * or more carefully warn folks.
+ */
+
+ function formData()
+ {
+ $this->out->elementStart(
+ 'fieldset',
+ array('id' => 'settings_openid')
+ );
+ $this->out->element('legend', null, _m('Trusted provider'));
+ $this->out->element('p', 'form_guide',
+ _m('By default, users are allowed to authenticate with any OpenID provider. ' .
+ 'If you are using your own OpenID service for shared sign-in, ' .
+ 'you can restrict access to only your own users here.'));
+ $this->out->elementStart('ul', 'form_data');
+
+ $this->li();
+ $this->input(
+ 'trusted_provider',
+ _m('Provider URL'),
+ _m('All OpenID logins will be sent to this URL; other providers may not be used.'),
+ 'openid'
+ );
+ $this->unli();
+
+ $this->li();
+ $this->input(
+ 'required_team',
+ _m('Required team'),
+ _m('Only allow logins from users in the given team (Launchpad extension).'),
+ 'openid'
+ );
+ $this->unli();
+
+ $this->out->elementEnd('ul');
+ $this->out->elementEnd('fieldset');
+
+ $this->out->elementStart(
+ 'fieldset',
+ array('id' => 'settings_openid-options')
+ );
+ $this->out->element('legend', null, _m('Options'));
+
+ $this->out->elementStart('ul', 'form_data');
+
+ $this->li();
+
+ $this->out->checkbox(
+ 'openidonly', _m('Enable OpenID-only mode'),
+ (bool) $this->value('openidonly', 'site'),
+ _m('Require all users to login via OpenID. WARNING: disables password authentication for all users!'),
+ 'true'
+ );
+ $this->unli();
+
+ $this->out->elementEnd('ul');
+
+ $this->out->elementEnd('fieldset');
+ }
+
+ /**
+ * Action elements
+ *
+ * @return void
+ */
+
+ function formActions()
+ {
+ $this->out->submit('submit', _('Save'), 'submit', null, _m('Save OpenID settings'));
+ }
+}
if (common_is_real_login()) {
$this->clientError(_m('Already logged in.'));
} else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
- $openid_url = $this->trimmed('openid_url');
+ $provider = common_config('openid', 'trusted_provider');
+ if ($provider) {
+ $openid_url = $provider;
+ } else {
+ $openid_url = $this->trimmed('openid_url');
+ }
oid_assert_allowed($openid_url);
$this->elementStart('ul', 'form_data');
$this->elementStart('li');
- $this->input('openid_url', _m('OpenID URL'),
- $this->openid_url,
- _m('Your OpenID URL'));
+ $provider = common_config('openid', 'trusted_provider');
+ if ($provider) {
+ $this->element('label', array(), _m('OpenID provider'));
+ $this->element('span', array(), $provider);
+ $this->element('p', 'form_guide',
+ _m('You will be sent to the provider\'s site for authentication.'));
+ $this->hidden('openid_url', $provider);
+ } else {
+ $this->input('openid_url', _m('OpenID URL'),
+ $this->openid_url,
+ _m('Your OpenID URL'));
+ }
$this->elementEnd('li');
$this->elementStart('li', array('id' => 'settings_rememberme'));
$this->checkbox('rememberme', _m('Remember me'), false,
{
$user = common_current_user();
- $this->elementStart('form', array('method' => 'post',
- 'id' => 'form_settings_openid_add',
- 'class' => 'form_settings',
- 'action' =>
- common_local_url('openidsettings')));
- $this->elementStart('fieldset', array('id' => 'settings_openid_add'));
- $this->element('legend', null, _m('Add OpenID'));
- $this->hidden('token', common_session_token());
- $this->element('p', 'form_guide',
- _m('If you want to add an OpenID to your account, ' .
- 'enter it in the box below and click "Add".'));
- $this->elementStart('ul', 'form_data');
- $this->elementStart('li');
- $this->element('label', array('for' => 'openid_url'),
- _m('OpenID URL'));
- $this->element('input', array('name' => 'openid_url',
- 'type' => 'text',
- 'id' => 'openid_url'));
- $this->elementEnd('li');
- $this->elementEnd('ul');
- $this->element('input', array('type' => 'submit',
- 'id' => 'settings_openid_add_action-submit',
- 'name' => 'add',
- 'class' => 'submit',
- 'value' => _m('Add')));
- $this->elementEnd('fieldset');
- $this->elementEnd('form');
-
+ if (!common_config('openid', 'trusted_provider')) {
+ $this->elementStart('form', array('method' => 'post',
+ 'id' => 'form_settings_openid_add',
+ 'class' => 'form_settings',
+ 'action' =>
+ common_local_url('openidsettings')));
+ $this->elementStart('fieldset', array('id' => 'settings_openid_add'));
+
+ $this->element('legend', null, _m('Add OpenID'));
+ $this->hidden('token', common_session_token());
+ $this->element('p', 'form_guide',
+ _m('If you want to add an OpenID to your account, ' .
+ 'enter it in the box below and click "Add".'));
+ $this->elementStart('ul', 'form_data');
+ $this->elementStart('li');
+ $this->element('label', array('for' => 'openid_url'),
+ _m('OpenID URL'));
+ $this->element('input', array('name' => 'openid_url',
+ 'type' => 'text',
+ 'id' => 'openid_url'));
+ $this->elementEnd('li');
+ $this->elementEnd('ul');
+ $this->element('input', array('type' => 'submit',
+ 'id' => 'settings_openid_add_action-submit',
+ 'name' => 'add',
+ 'class' => 'submit',
+ 'value' => _m('Add')));
+ $this->elementEnd('fieldset');
+ $this->elementEnd('form');
+ }
$oid = new User_openid();
$oid->user_id = $user->id;
}
if ($this->arg('add')) {
- $result = oid_authenticate($this->trimmed('openid_url'),
- 'finishaddopenid');
- if (is_string($result)) { // error message
- $this->showForm($result);
+ if (common_config('openid', 'trusted_provider')) {
+ $this->showForm(_m("Can't add new providers."));
+ } else {
+ $result = oid_authenticate($this->trimmed('openid_url'),
+ 'finishaddopenid');
+ if (is_string($result)) { // error message
+ $this->showForm($result);
+ }
}
} else if ($this->arg('remove')) {
$this->removeOpenid();
projects / quix0rs-gnu-social.git / commitdiff