Changeset 26608 for extensions/oAuth/auth.php

Timestamp:

Jan 11, 2014, 12:08:40 PM (10 years ago)

Author:

mistic100

Message:

finish updating guides, fix flow issues, update language file

File:

• extensions/oAuth/auth.php (modified) (9 diffs)

extensions/oAuth/auth.php

@@ -4 +4 @@
 
 global $hybridauth_conf;
+
+// OpenID is always enabled
+$hybridauth_conf['providers']['OpenID']['enabled'] = true;
+
 require_once(OAUTH_PATH . 'include/hybridauth/Hybrid/Auth.php');
 
@@ -9 +13 @@
 
 try {
-  // inputs
-  if ($provider == 'OpenID' and !isset($_GET['openid_identifier']))
-  {
-    throw new Exception('Invalid OpenID!', 1003);
-  }
-  
-  // OpenID is always enabled
-  $hybridauth_conf['providers']['OpenID']['enabled'] = true;
-  
   if (!array_key_exists($provider, $hybridauth_conf['providers'])
       or !$hybridauth_conf['providers'][$provider]['enabled']
@@ -27 +22 @@
   if ($provider == 'Persona')
   {
+    if (!verify_ephemeral_key(@$_POST['key']) | empty($_POST['assertion']))
+    {
+      header('HTTP/1.1 403 Forbidden');
+      exit;
+    }
+    
     $response = persona_verify($_POST['assertion']);
     
@@ -41 +42 @@
   else
   {
+    if ($provider == 'OpenID' and empty($_GET['openid_identifier']))
+    {
+      throw new Exception('Invalid OpenID!', 1003);
+    }
+    
     $hybridauth = new Hybrid_Auth($hybridauth_conf);
     
-    // connected
     if ($hybridauth->isConnectedWith($provider))
     {
@@ -53 +58 @@
   }
   
+  // connected
   if (!empty($oauth_id))
   {
@@ -61 +67 @@
 ;';
     $result = pwg_query($query);
+
     // registered : log_user and redirect
     if (pwg_db_num_rows($result))
@@ -111 +118 @@
   else
   {
+    if (!verify_ephemeral_key(@$_GET['key']))
+    {
+      throw new Exception('Forbidden', 403);
+    }
+    
     $template->assign('LOADING', '&openid_identifier='.@$_GET['openid_identifier'].'&init_auth=1');
   }
@@ -125 +137 @@
    404 : User not found
  other errors :
+   403 : Invalid ephemeral key
    503 : Persona error
   1002 : Invalid provider
@@ -149 +162 @@
   
   'OAUTH_PATH' => OAUTH_PATH,
-  'PROVIDER' => $provider,
+  'PROVIDER' => $hybridauth_conf['providers'][$provider]['name'],
   'SELF_URL' => OAUTH_PATH . 'auth.php?provider='.$provider,
   ));