plugins/OpenID/openidsettings.php

   1 <?php
   2 /**
   3  * StatusNet, the distributed open-source microblogging tool
   4  *
   5  * Settings for OpenID
   6  *
   7  * PHP version 5
   8  *
   9  * LICENCE: This program is free software: you can redistribute it and/or modify
  10  * it under the terms of the GNU Affero General Public License as published by
  11  * the Free Software Foundation, either version 3 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU Affero General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Affero General Public License
  20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21  *
  22  * @category  Settings
  23  * @package   StatusNet
  24  * @author    Evan Prodromou <evan@status.net>
  25  * @copyright 2008-2009 StatusNet, Inc.
  26  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  27  * @link      http://status.net/
  28  */
  29
  30 if (!defined('STATUSNET')) {
  31     exit(1);
  32 }
  33
  34 require_once INSTALLDIR.'/plugins/OpenID/openid.php';
  35
  36 /**
  37  * Settings for OpenID
  38  *
  39  * Lets users add, edit and delete OpenIDs from their account
  40  *
  41  * @category Settings
  42  * @package  StatusNet
  43  * @author   Evan Prodromou <evan@status.net>
  44  * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  45  * @link     http://status.net/
  46  */
  47
  48 class OpenidsettingsAction extends AccountSettingsAction
  49 {
  50     /**
  51      * Title of the page
  52      *
  53      * @return string Page title
  54      */
  55
  56     function title()
  57     {
  58         return _m('OpenID settings');
  59     }
  60
  61     /**
  62      * Instructions for use
  63      *
  64      * @return string Instructions for use
  65      */
  66
  67     function getInstructions()
  68     {
  69         return _m('[OpenID](%%doc.openid%%) lets you log into many sites' .
  70                  ' with the same user account.'.
  71                  ' Manage your associated OpenIDs from here.');
  72     }
  73
  74     function showScripts()
  75     {
  76         parent::showScripts();
  77         $this->autofocus('openid_url');
  78     }
  79
  80     /**
  81      * Show the form for OpenID management
  82      *
  83      * We have one form with a few different submit buttons to do different things.
  84      *
  85      * @return void
  86      */
  87
  88     function showContent()
  89     {
  90         $user = common_current_user();
  91
  92         if (!common_config('openid', 'trusted_provider')) {
  93             $this->elementStart('form', array('method' => 'post',
  94                                               'id' => 'form_settings_openid_add',
  95                                               'class' => 'form_settings',
  96                                               'action' =>
  97                                               common_local_url('openidsettings')));
  98             $this->elementStart('fieldset', array('id' => 'settings_openid_add'));
  99
 100             $this->element('legend', null, _m('Add OpenID'));
 101             $this->hidden('token', common_session_token());
 102             $this->element('p', 'form_guide',
 103                            _m('If you want to add an OpenID to your account, ' .
 104                              'enter it in the box below and click "Add".'));
 105             $this->elementStart('ul', 'form_data');
 106             $this->elementStart('li');
 107             $this->element('label', array('for' => 'openid_url'),
 108                            _m('OpenID URL'));
 109             $this->element('input', array('name' => 'openid_url',
 110                                           'type' => 'text',
 111                                           'id' => 'openid_url'));
 112             $this->elementEnd('li');
 113             $this->elementEnd('ul');
 114             $this->element('input', array('type' => 'submit',
 115                                           'id' => 'settings_openid_add_action-submit',
 116                                           'name' => 'add',
 117                                           'class' => 'submit',
 118                                           'value' => _m('Add')));
 119             $this->elementEnd('fieldset');
 120             $this->elementEnd('form');
 121         }
 122         $oid = new User_openid();
 123
 124         $oid->user_id = $user->id;
 125
 126         $cnt = $oid->find();
 127
 128         if ($cnt > 0) {
 129
 130             $this->element('h2', null, _m('Remove OpenID'));
 131
 132             if ($cnt == 1 && !$user->password) {
 133
 134                 $this->element('p', 'form_guide',
 135                                _m('Removing your only OpenID '.
 136                                  'would make it impossible to log in! ' .
 137                                  'If you need to remove it, '.
 138                                  'add another OpenID first.'));
 139
 140                 if ($oid->fetch()) {
 141                     $this->elementStart('p');
 142                     $this->element('a', array('href' => $oid->canonical),
 143                                    $oid->display);
 144                     $this->elementEnd('p');
 145                 }
 146
 147             } else {
 148
 149                 $this->element('p', 'form_guide',
 150                                _m('You can remove an OpenID from your account '.
 151                                  'by clicking the button marked "Remove".'));
 152                 $idx = 0;
 153
 154                 while ($oid->fetch()) {
 155                     $this->elementStart('form',
 156                                         array('method' => 'POST',
 157                                               'id' => 'form_settings_openid_delete' . $idx,
 158                                               'class' => 'form_settings',
 159                                               'action' =>
 160                                               common_local_url('openidsettings')));
 161                     $this->elementStart('fieldset');
 162                     $this->hidden('token', common_session_token());
 163                     $this->element('a', array('href' => $oid->canonical),
 164                                    $oid->display);
 165                     $this->element('input', array('type' => 'hidden',
 166                                                   'id' => 'openid_url'.$idx,
 167                                                   'name' => 'openid_url',
 168                                                   'value' => $oid->canonical));
 169                     $this->element('input', array('type' => 'submit',
 170                                                   'id' => 'remove'.$idx,
 171                                                   'name' => 'remove',
 172                                                   'class' => 'submit remove',
 173                                                   'value' => _m('Remove')));
 174                     $this->elementEnd('fieldset');
 175                     $this->elementEnd('form');
 176                     $idx++;
 177                 }
 178             }
 179         }
 180
 181         $this->elementStart('form', array('method' => 'post',
 182                                           'id' => 'form_settings_openid_trustroots',
 183                                           'class' => 'form_settings',
 184                                           'action' =>
 185                                           common_local_url('openidsettings')));
 186         $this->elementStart('fieldset', array('id' => 'settings_openid_trustroots'));
 187         $this->element('legend', null, _m('OpenID Trusted Sites'));
 188         $this->hidden('token', common_session_token());
 189         $this->element('p', 'form_guide',
 190                        _m('The following sites are allowed to access your ' .
 191                        'identity and log you in. You can remove a site from ' .
 192                        'this list to deny it access to your OpenID.'));
 193         $this->elementStart('ul', 'form_data');
 194         $user_openid_trustroot = new User_openid_trustroot();
 195         $user_openid_trustroot->user_id=$user->id;
 196         if($user_openid_trustroot->find()) {
 197             while($user_openid_trustroot->fetch()) {
 198                 $this->elementStart('li');
 199                 $this->element('input', array('name' => 'openid_trustroot[]',
 200                                               'type' => 'checkbox',
 201                                               'class' => 'checkbox',
 202                                               'value' => $user_openid_trustroot->trustroot,
 203                                               'id' => 'openid_trustroot_' . crc32($user_openid_trustroot->trustroot)));
 204                 $this->element('label', array('class'=>'checkbox', 'for' => 'openid_trustroot_' . crc32($user_openid_trustroot->trustroot)),
 205                                $user_openid_trustroot->trustroot);
 206                 $this->elementEnd('li');
 207             }
 208         }
 209         $this->elementEnd('ul');
 210         $this->element('input', array('type' => 'submit',
 211                                       'id' => 'settings_openid_trustroots_action-submit',
 212                                       'name' => 'remove_trustroots',
 213                                       'class' => 'submit',
 214                                       'value' => _m('Remove')));
 215         $this->elementEnd('fieldset');
 216         $this->elementEnd('form');
 217     }
 218
 219     /**
 220      * Handle a POST request
 221      *
 222      * Muxes to different sub-functions based on which button was pushed
 223      *
 224      * @return void
 225      */
 226
 227     function handlePost()
 228     {
 229         // CSRF protection
 230         $token = $this->trimmed('token');
 231         if (!$token || $token != common_session_token()) {
 232             $this->showForm(_m('There was a problem with your session token. '.
 233                               'Try again, please.'));
 234             return;
 235         }
 236
 237         if ($this->arg('add')) {
 238             if (common_config('openid', 'trusted_provider')) {
 239                 $this->showForm(_m("Can't add new providers."));
 240             } else {
 241                 $result = oid_authenticate($this->trimmed('openid_url'),
 242                                            'finishaddopenid');
 243                 if (is_string($result)) { // error message
 244                     $this->showForm($result);
 245                 }
 246             }
 247         } else if ($this->arg('remove')) {
 248             $this->removeOpenid();
 249         } else if($this->arg('remove_trustroots')) {
 250             $this->removeTrustroots();
 251         } else {
 252             $this->showForm(_m('Something weird happened.'));
 253         }
 254     }
 255
 256     /**
 257      * Handles a request to remove OpenID trustroots from the user's account
 258      *
 259      * Validates input and, if everything is OK, deletes the trustroots.
 260      * Reloads the form with a success or error notification.
 261      *
 262      * @return void
 263      */
 264
 265     function removeTrustroots()
 266     {
 267         $user = common_current_user();
 268         $trustroots = $this->arg('openid_trustroot');
 269         if($trustroots) {
 270             foreach($trustroots as $trustroot) {
 271                 $user_openid_trustroot = User_openid_trustroot::pkeyGet(
 272                                                 array('user_id'=>$user->id, 'trustroot'=>$trustroot));
 273                 if($user_openid_trustroot) {
 274                     $user_openid_trustroot->delete();
 275                 } else {
 276                     $this->showForm(_m('No such OpenID trustroot.'));
 277                     return;
 278                 }
 279             }
 280             $this->showForm(_m('Trustroots removed'), true);
 281         } else {
 282             $this->showForm();
 283         }
 284         return;
 285     }
 286
 287     /**
 288      * Handles a request to remove an OpenID from the user's account
 289      *
 290      * Validates input and, if everything is OK, deletes the OpenID.
 291      * Reloads the form with a success or error notification.
 292      *
 293      * @return void
 294      */
 295
 296     function removeOpenid()
 297     {
 298         $openid_url = $this->trimmed('openid_url');
 299
 300         $oid = User_openid::staticGet('canonical', $openid_url);
 301
 302         if (!$oid) {
 303             $this->showForm(_m('No such OpenID.'));
 304             return;
 305         }
 306         $cur = common_current_user();
 307         if (!$cur || $oid->user_id != $cur->id) {
 308             $this->showForm(_m('That OpenID does not belong to you.'));
 309             return;
 310         }
 311         $oid->delete();
 312         $this->showForm(_m('OpenID removed.'), true);
 313         return;
 314     }
 315 }