git.cweiske.de / phorkie.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
FIX: Revamped security measures
[phorkie.git] / www / login.php
diff --git a/www/login.php b/www/login.php
index f05f98014e0cf679b1099c849294ed32c66d632b..a2cf97c211ebcaa69fc5fe5fa85b927ffa9da9c6 100644 (file)
--- a/www/login.php
+++ b/www/login.php
@@ -1,45 +1,22 @@
 <?php
-/**
- * OpenID 
- * 
- * PHP Version 5.2.0+
- * 
- * @category  Auth
- * @package   OpenID
- * @author    Bill Shupp <hostmaster@shupp.org> 
- * @copyright 2009 Bill Shupp
- * @license   http://www.opensource.org/licenses/bsd-license.php FreeBSD
- * @link      http://github.com/shupp/openid
- */
 namespace phorkie;
-// A tool for testing Relying Party functionality
-set_include_path(
-    __DIR__ . '/../../src/'
-    . PATH_SEPARATOR . get_include_path()
-);
-
+$noSecurityCheck = true;
 require_once 'www-header.php';
-require_once 'openid/config.php';
-
 
 if (isset($_REQUEST['logout'])) {
     unset($_SESSION);
     session_destroy();
-    $redirect = 'http://' . $_SERVER['HTTP_HOST'];
-    header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL));
-    exit;
+    header('Location: ' . Tools::fullUrl('/'));
+    exit();
 }
 
 if (!count($_GET) && !count($_POST)) {
-    render(
-        'login',
-        null
-    );
-    exit;
+    render('login');
+    exit();
 }
 
 // Hackaround Non-Javascript Login Page
-if (!count($_POST) && isset($_GET['start'])) {
+if (!count($_POST) && isset($_GET['openid_url'])) {
     $_POST = $_GET;
 }
 
@@ -51,6 +28,9 @@ if (isset($_POST['openid_url'])) {
     $openid_url = null;
 }
 
+$realm    = Tools::fullUrl('/');
+$returnTo = Tools::fullUrl('/login');
+
 try {
     $o = new \OpenID_RelyingParty($returnTo, $realm, $openid_url);
 } catch (OpenID_Exception $e) {
@@ -69,7 +49,7 @@ if (!empty($_POST['disable_associations']) || !empty($_SESSION['disable_associat
 $log = new \OpenID_Observer_Log;
 \OpenID::attach($log);
 
-if (isset($_POST['start'])) {
+if (isset($_POST['openid_url'])) {
 
     $_SESSION['openid_url'] = $openid_url;
     try {
@@ -82,15 +62,9 @@ if (isset($_POST['start'])) {
         exit;
     }
 
-    // checkid_immediate
-    if (!empty($_POST['checkid_immediate'])) {
-        $authRequest->setMode('checkid_immediate');
-    }
-
     // SREG
     $sreg = new \OpenID_Extension_SREG11(\OpenID_Extension::REQUEST);
-    $sreg->set('required', 'email,firstname,lastname,nickname');
-    $sreg->set('optional', 'gender,dob');
+    $sreg->set('required', 'email,fullname');
     $authRequest->addExtension($sreg);
 
     // AX
@@ -102,117 +76,80 @@ if (isset($_POST['start'])) {
     $ax->set('required', 'email,firstname,lastname');
     $authRequest->addExtension($ax);
 
-    // UI
-    if (!empty($_POST['ui'])) {
-        $ui = new \OpenID_Extension_UI(\OpenID_Extension::REQUEST);
-        $ui->set('mode', 'popup');
-        $ui->set('language', 'en-US');
-        $authRequest->addExtension($ui);
-    }
-
-    // OAuth
-    if (!empty($_POST['oauth'])) {
-        $oauth = new \OpenID_Extension_OAuth(\OpenID_Extension::REQUEST);
-        $oauth->set('consumer', $_POST['oauth_consumer_key']);
-        $_SESSION['OAuth_consumer_key']    = $_POST['oauth_consumer_key'];
-        $_SESSION['OAuth_consumer_secret'] = $_POST['oauth_consumer_secret'];
-
-        $oauth->set('scope', $_POST['oauth_scope']);
-        $_SESSION['OAuth_scope'] = $_POST['oauth_scope'];
-
-        $_SESSION['OAuth_access_token_url']    = $_POST['oauth_access_token_url'];
-        $_SESSION['OAuth_access_token_method'] = $_POST['oauth_access_token_method'];
-
-        $authRequest->addExtension($oauth);
-    }
-    
     $url = $authRequest->getAuthorizeURL();
     
-    if (empty($_POST['debug'])) {
-        header("Location: $url");
-        exit;
-    }
+    header("Location: $url");
+    exit;
     
+}
+
+if (isset($_SESSION['openid_url'])) {
+    $usid = $_SESSION['openid_url'];
+    unset($_SESSION['openid_url']);
 } else {
-    if (isset($_SESSION['openid_url'])) {
-        $usid = $_SESSION['openid_url'];
-        unset($_SESSION['openid_url']);
-    } else {
-        $usid = null;
-    }
+    $usid = null;
+}
 
-    unset($_SESSION['disable_associations']);
+unset($_SESSION['disable_associations']);
 
-    if (!count($_POST)) {
-        list(, $queryString) = explode('?', $_SERVER['REQUEST_URI']);
-    } else {
-        // I hate php sometimes
-        $queryString = file_get_contents('php://input');
-    }
+if (!count($_POST)) {
+    list(, $queryString) = explode('?', $_SERVER['REQUEST_URI']);
+} else {
+    // I hate php sometimes
+    $queryString = file_get_contents('php://input');
+}
 
-    $message = new \OpenID_Message($queryString, \OpenID_Message::FORMAT_HTTP);
-    $id      = $message->get('openid.claimed_id');
-    $mode    = $message->get('openid.mode');
+$message = new \OpenID_Message($queryString, \OpenID_Message::FORMAT_HTTP);
+$id      = $message->get('openid.claimed_id');
+$mode    = $message->get('openid.mode');
 
-    try {
-        $result = $o->verify(new \Net_URL2($returnTo . '?' . $queryString), $message);
-
-        if ($result->success()) {
-            $status  = "<tr><td>Status:</td><td><font color='green'>SUCCESS!";
-            $status .= " ({$result->getAssertionMethod()})</font></td></tr>";
-        } else {
-            $status  = "<tr><td>Status:</td><td><font color='red'>FAIL!";
-            $status .= " ({$result->getAssertionMethod()})</font></td></tr>";
-        }
-    } catch (OpenID_Exception $e) {
-        $status  = "<tr><td>Status:</td><td><font color='red'>EXCEPTION!";
-        $status .= " ({$e->getMessage()} : {$e->getCode()})</font></td></tr>";
-    }
+try {
+    $result = $o->verify(new \Net_URL2($returnTo . '?' . $queryString), $message);
 
-    // OAuth hyprid fetching access token
-    if (isset($_SESSION['OAuth_consumer_key'],
-              $_SESSION['OAuth_consumer_secret'],
-              $_SESSION['OAuth_access_token_url'],
-              $_SESSION['OAuth_access_token_method'])) {
-
-        try {
-            $oauth = new \OpenID_Extension_OAuth(\OpenID_Extension::RESPONSE,
-                                                $message);
-
-            // Fix line lengths.
-            $consumerKey    = $_SESSION['OAuth_consumer_key'];
-            $consumerSecret = $_SESSION['OAuth_consumer_key'];
-            $tokenURL       = $_SESSION['OAuth_access_token_url'];
-            $tokenMethod    = $_SESSION['OAuth_access_token_method'];
-
-            $oauthData = $oauth->getAccessToken($consumerKey,
-                                                $consumerSecret,
-                                                $tokenURL,
-                                                array(),
-                                                $tokenMethod);
-
-        } catch (Exception $e) {
-        }
+    if ($result->success()) {
+        $status  = "<tr><td>Status:</td><td><font color='green'>SUCCESS!";
+        $status .= " ({$result->getAssertionMethod()})</font></td></tr>";
+    } else {
+        $status  = "<tr><td>Status:</td><td><font color='red'>FAIL!";
+        $status .= " ({$result->getAssertionMethod()})</font></td></tr>";
     }
-
-    $openid = $message->getArrayFormat();
-
-    $email = (isset($openid['openid.ext1.value.email'])) ? $openid['openid.ext1.value.email'] : null;
-    $email = (isset($openid['openid.ext2.value.email']) && !isset($email)) ? $openid['openid.ext2.value.email'] : $email;
-    $email = (isset($openid['openid.sreg.email']) && !isset($email)) ? $openid['openid.sreg.email'] : $email;
-    $email = (isset($openid['openid.ax.value.email']) && !isset($email)) ? $openid['openid.ax.value.email'] : $email;
-    $_SESSION['email'] = (isset($email)) ? $email : $GLOBALS['phorkie']['auth']['anonymousEmail'];
-
-    $name = (isset($openid['openid.ext1.value.firstname']) && isset($openid['openid.ext1.value.lastname'])) ? $openid['openid.ext1.value.firstname']." ".$openid['openid.ext1.value.lastname'] : null;
-    $name = (isset($openid['openid.sreg.firstname']) && isset($openid['openid.sreg.lastname']) && !isset($name)) ? $openid['openid.sreg.firstname']." ".$openid['openid.sreg.lastname'] : $name;
-    $name = (isset($openid['openid.sreg.nickname']) && !isset($name)) ? $openid['openid.sreg.nickname'] : $name;
-    $_SESSION['name'] = (isset($name)) ? $name : $_SERVER['REMOTE_ADDR'];
-
-    $_SESSION['identity'] = $openid['openid.identity'];
-
-    $redirect = 'http://' . $_SERVER['HTTP_HOST'] . $_SESSION['REQUEST_URI'];
-    header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL));
-    exit;
-}
-
+} catch (OpenID_Exception $e) {
+    $status  = "<tr><td>Status:</td><td><font color='red'>EXCEPTION!";
+    $status .= " ({$e->getMessage()} : {$e->getCode()})</font></td></tr>";
+  }
+
+
+$openid = $message->getArrayFormat();
+
+$email = isset($openid['openid.ext1.value.email'])
+    ? $openid['openid.ext1.value.email']
+    : null;
+$email = isset($openid['openid.ext2.value.email']) && !isset($email)
+    ? $openid['openid.ext2.value.email']
+    : $email;
+$email = isset($openid['openid.sreg.email']) && !isset($email)
+    ? $openid['openid.sreg.email']
+    : $email;
+$email = isset($openid['openid.ax.value.email']) && !isset($email)
+    ? $openid['openid.ax.value.email']
+    : $email;
+$_SESSION['email'] = isset($email)
+    ? $email
+    : $GLOBALS['phorkie']['auth']['anonymousEmail'];
+
+$name = isset($openid['openid.ext1.value.firstname'])
+    && isset($openid['openid.ext1.value.lastname'])
+    ? $openid['openid.ext1.value.firstname'] . ' '
+    . $openid['openid.ext1.value.lastname']
+    : null;
+$name = isset($openid['openid.sreg.fullname']) && !isset($name)
+    ? $openid['openid.sreg.fullname']
+    : $name;
+
+$_SESSION['name'] = isset($name) ? $name : $_SERVER['REMOTE_ADDR'];
+$_SESSION['identity'] = $openid['openid.identity'];
+
+$redirect = 'http://' . $_SERVER['HTTP_HOST'] . $_SESSION['REQUEST_URI'];
+header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL));
+exit;
 ?>
Self-hosted pastebin software written in PHP. Pastes are editable, may have multiple files and are stored in git repositories.