Upgrade twig to version 3 for php 8.1

[anoweco.git] / www / token.php

diff --git a/www/token.php b/www/token.php
index 6d417c695817bafcfa22275f5508c2cc56fd9817..67d6bb19fde0aa3c1f26c643bd2658e42d01cbfb 100644 (file)
--- a/www/token.php
+++ b/www/token.php
@@ -1,5 +1,6 @@
 <?php
 header('HTTP/1.0 500 Internal Server Error');
+header("Access-Control-Allow-Origin: *");
 
 function error($msg)
 {
@@ -47,7 +48,13 @@ if ($_SERVER['REQUEST_METHOD'] == 'GET') {
     } else {
         error('Authorization HTTP header missing');
     }
-    list($bearer, $token) = explode(' ', $auth, 2);
+
+    $parts = explode(' ', $auth, 2);
+    if (count($parts) != 2) {
+        error('Authorization header must container "Bearer" and the token');
+    }
+
+    list($bearer, $token) = $parts;
     if ($bearer !== 'Bearer') {
         error('Authorization header must start with "Bearer"');
     }
@@ -72,8 +79,8 @@ if ($_SERVER['REQUEST_METHOD'] == 'GET') {
     }
 
     header('HTTP/1.0 200 OK');
-    header('Content-type: application/x-www-form-urlencoded');
-    echo http_build_query(
+    header('Content-type: application/json');
+    echo json_encode(
         array(
             'me'        => $me,
             'client_id' => $client_id,
@@ -83,7 +90,8 @@ if ($_SERVER['REQUEST_METHOD'] == 'GET') {
 
 } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
     //generate token
-    $me           = verifyUrlParameter($_POST, 'me');
+    //we ignore the "me" parameter; it's for proxies only
+    // see https://github.com/cweiske/anoweco/issues/3
     $redirect_uri = verifyUrlParameter($_POST, 'redirect_uri');
     $client_id    = verifyUrlParameter($_POST, 'client_id');
     $code         = verifyParameter($_POST, 'code');//auth token
@@ -93,16 +101,13 @@ if ($_SERVER['REQUEST_METHOD'] == 'GET') {
     parse_str(base64_decode($code), $codeParts);
     $emoji     = verifyParameter($codeParts, 'emoji');
     $signature = verifyParameter($codeParts, 'signature');
-    $codeMe    = verifyUrlParameter($codeParts, 'me');
+    $me        = verifyUrlParameter($codeParts, 'me');
     if ($emoji != '\360\237\222\251') {
         error('Auth token: Dog poo missing');
     }
     if ($signature != 'FIXME') {
         error('Auth token: Invalid signature');
     }
-    if ($me !== $codeMe) {
-        error('Auth token is not valid for the given "me"');
-    }
 
     //FIXME: check if state are set
     //FIXME: check auth endpoint if parameters are valid
@@ -122,10 +127,11 @@ if ($_SERVER['REQUEST_METHOD'] == 'GET') {
         )
     );
     header('HTTP/1.0 200 OK');
-    header('Content-type: application/x-www-form-urlencoded');
-    echo http_build_query(
+    header('Content-type: application/json');
+    echo json_encode(
         array(
             'access_token' => $access_token,
+            'token_type' => 'Bearer',
             'me' => $me,
             'scope' => $scope
         )