From: Justin J. Novack Date: Sun, 16 Sep 2012 05:17:46 +0000 (-0400) Subject: Added OpenID Authentication X-Git-Tag: v0.3.0~42^2~56 X-Git-Url: https://git.cweiske.de/phorkie.git/commitdiff_plain/a73791f16d10ea0e2c477f29d9049d75516aa774 Added OpenID Authentication --- diff --git a/data/config.default.php b/data/config.default.php index 88c9ae5..7ecbda3 100644 --- a/data/config.default.php +++ b/data/config.default.php @@ -12,6 +12,11 @@ $GLOBALS['phorkie']['cfg'] = array( 'geshi' => 'MediaWiki/geshi/geshi/geshi.php', 'index' => 'new'//"new" or "list" ); +$GLOBALS['phorkie']['auth'] = array( + 'secure' => 0, // 0 = public, no authentication, 1 = protect adds/edits/deletes, 2 = use authentication + 'userlist' => false, // true = user must be explicitly defined, false = anyone allowed, but they must authenticate + 'anonymousEmail' => 'anonymous@phorkie' // Email for non-authenticated commits +); $GLOBALS['phorkie']['tools'] = array( '\\phorkie\\Tool_Xmllint' => true, '\\phorkie\\Tool_PHPlint' => true, diff --git a/data/config.php.dist b/data/config.php.dist index 1e814bd..e90f704 100644 --- a/data/config.php.dist +++ b/data/config.php.dist @@ -5,4 +5,8 @@ //$GLOBALS['phorkie']['cfg']['git']['private'] = 'ssh://git@bogo:paste/'; //$GLOBALS['phorkie']['cfg']['elasticsearch'] = 'http://localhost:9200/phorkie/'; //$GLOBALS['phorkie']['cfg']['setupcheck'] = false; +//$GLOBALS['phorkie']['users'] = array( +// 'https://www.google.com/accounts/o8/id?id=ABCDEFGHIJKLMNOPQRSTUVWXYZ', +// 'http://anonymous.phorkie.openid' +//); ?> diff --git a/data/templates/base.htm b/data/templates/base.htm index 2b8544b..8192b6b 100644 --- a/data/templates/base.htm +++ b/data/templates/base.htm @@ -25,6 +25,14 @@
  • List all
    • + {% if identity %} +
  • + {{name}} ({{email}}) +
    • +
  • + Logout +
    • + {% endif %} {% if db.adapter %}
  • diff --git a/data/templates/forbidden.htm b/data/templates/forbidden.htm new file mode 100644 index 0000000..ad40a9f --- /dev/null +++ b/data/templates/forbidden.htm @@ -0,0 +1,21 @@ +{% extends "base.htm" %} +{% block title %}Access Denied{% endblock %} + +{% block content %} + +
    + Access Denied + +
    +{% endblock %} + +{% block sidebar %} + {% if recents.results %} +

    Recently created

    +
      + {% for repo in recents.repos %} + {% include 'repo-sidebar-list.htm' %} + {% endfor %} +
    + {% endif %} +{% endblock %} diff --git a/data/templates/login.htm b/data/templates/login.htm new file mode 100644 index 0000000..13d86be --- /dev/null +++ b/data/templates/login.htm @@ -0,0 +1,44 @@ +{% extends "base.htm" %} +{% block title %}Login{% endblock %} + +{% block content %} + + + + + + + + + + + +
    + Sign-in +
    +

    Please choose your account provider

    +
    + + +
    +
    +

    or enter your OpenID URL.

    + + +
    +
    +
    +{% endblock %} + +{% block sidebar %} + {% if recents.results %} +

    Recently created

    +
      + {% for repo in recents.repos %} + {% include 'repo-sidebar-list.htm' %} + {% endfor %} +
    + {% endif %} +{% endblock %} diff --git a/src/openid/config.php b/src/openid/config.php new file mode 100644 index 0000000..fdec5e1 --- /dev/null +++ b/src/openid/config.php @@ -0,0 +1,55 @@ + + * @copyright 2009 Bill Shupp + * @license http://www.opensource.org/licenses/bsd-license.php FreeBSD + * @link http://github.com/shupp/openid + */ + +set_include_path(dirname(__FILE__) . '/../../:' . get_include_path()); + +/** + * Required files + */ +require_once 'OpenID/RelyingParty.php'; +require_once 'OpenID/Discover.php'; +require_once 'OpenID/Store.php'; +require_once 'OpenID/Extension/SREG10.php'; +require_once 'OpenID/Extension/SREG11.php'; +require_once 'OpenID/Extension/AX.php'; +require_once 'OpenID/Extension/UI.php'; +require_once 'OpenID/Extension/OAuth.php'; +require_once 'OpenID/Message.php'; +require_once 'OpenID/Observer/Log.php'; +require_once 'Net/URL2.php'; + +// Determine realm and return_to +$base = 'http'; +if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') { + $base .= 's'; +} +$base .= '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT']; + +$realm = $base . '/'; +$returnTo = $base . dirname($_SERVER['PHP_SELF']); +if ($returnTo[strlen($returnTo) - 1] != '/') { + $returnTo .= '/'; +} +$returnTo .= 'auth'; + +// SQL storage example +// $storeOptions = array( +// 'dsn' => 'mysql://user:pass@db.example.com/openid' +// ); +// OpenID::setStore(OpenID_Store::factory('MDB2', $storeOptions)); +// +// // The first time you run it, you'll also need to create the tables: +// OpenID::getStore()->createTables(); + +?> diff --git a/src/openid/wrapper.php b/src/openid/wrapper.php new file mode 100644 index 0000000..cb57f4e --- /dev/null +++ b/src/openid/wrapper.php @@ -0,0 +1,27 @@ + + * @copyright 2009 Bill Shupp + * @license http://www.opensource.org/licenses/bsd-license.php FreeBSD + * @link http://github.com/shupp/openid + */ +?> + + + PEAR OpenID Debug + + + + + + diff --git a/www/.htaccess b/www/.htaccess index a8f2eed..fd2963b 100644 --- a/www/.htaccess +++ b/www/.htaccess @@ -19,3 +19,7 @@ RewriteRule ^list/([0-9]+)$ /list.php?page=$1 RewriteRule ^search$ /search.php RewriteRule ^search/([0-9]+)$ /search.php?page=$1 + +RewriteRule ^auth$ /auth.php +RewriteRule ^login$ /login.php +RewriteRule ^forbidden$ /forbidden.php diff --git a/www/auth.php b/www/auth.php new file mode 100644 index 0000000..8fe38e0 --- /dev/null +++ b/www/auth.php @@ -0,0 +1,258 @@ + + * @copyright 2009 Bill Shupp + * @license http://www.opensource.org/licenses/bsd-license.php FreeBSD + * @link http://github.com/shupp/openid + */ + +// A tool for testing Relying Party functionality +set_include_path( + __DIR__ . '/../../src/' + . PATH_SEPARATOR . get_include_path() +); + +require_once 'www-header.php'; +require_once 'openid/config.php'; + + +if (isset($_REQUEST['logout'])) { + unset($_SESSION); + session_destroy(); + $redirect = 'http://' . $_SERVER['HTTP_HOST']; + header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL)); + exit; +} + +if (!count($_GET) && !count($_POST)) { + $redirect = 'http://' . $_SERVER['HTTP_HOST'] . "/login"; + header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL)); + exit; +} + +// Hackaround Non-Javascript Login Page +if (!count($_POST) && isset($_GET['start'])) { + $_POST = $_GET; +} + +if (isset($_POST['identifier'])) { + $identifier = $_POST['identifier']; +} else if (isset($_SESSION['identifier'])) { + $identifier = $_SESSION['identifier']; +} else { + $identifier = null; +} + +try { + $o = new OpenID_RelyingParty($returnTo, $realm, $identifier); +} catch (OpenID_Exception $e) { + $contents = "
    \n"; + $contents .= "
    " . $e->getMessage() . "
    \n"; + $contents .= "
    "; + include_once 'openid/wrapper.php'; + exit; +} + +if (!empty($_POST['disable_associations']) + || !empty($_SESSION['disable_associations'])) { + + $o->disableAssociations(); + $_SESSION['disable_associations'] = true; +} + +$log = new OpenID_Observer_Log; +OpenID::attach($log); + +if (isset($_POST['start'])) { + + $_SESSION['identifier'] = $identifier; + try { + $authRequest = $o->prepare(); + } catch (OpenID_Exception $e) { + $contents = "
    \n"; + $contents .= "
    " . $e->getMessage() . "
    \n"; + $contents .= "
    "; + include_once 'openid/wrapper.php'; + exit; + } + + // checkid_immediate + if (!empty($_POST['checkid_immediate'])) { + $authRequest->setMode('checkid_immediate'); + } + + // SREG + if (!empty($_POST['sreg'])) { + $sreg = new OpenID_Extension_SREG11(OpenID_Extension::REQUEST); + $sreg->set('required', 'email,firstname,lastname,nickname'); + $sreg->set('optional', 'gender,dob'); + $authRequest->addExtension($sreg); + } + + // AX + if (!empty($_POST['ax'])) { + $ax = new OpenID_Extension_AX(OpenID_Extension::REQUEST); + $ax->set('type.email', 'http://axschema.org/contact/email'); + $ax->set('type.firstname', 'http://axschema.org/namePerson/first'); + $ax->set('type.lastname', 'http://axschema.org/namePerson/last'); + $ax->set('mode', 'fetch_request'); + $ax->set('required', 'email,firstname,lastname'); + $authRequest->addExtension($ax); + } + + // UI + if (!empty($_POST['ui'])) { + $ui = new OpenID_Extension_UI(OpenID_Extension::REQUEST); + $ui->set('mode', 'popup'); + $ui->set('language', 'en-US'); + $authRequest->addExtension($ui); + } + + // OAuth + if (!empty($_POST['oauth'])) { + $oauth = new OpenID_Extension_OAuth(OpenID_Extension::REQUEST); + $oauth->set('consumer', $_POST['oauth_consumer_key']); + $_SESSION['OAuth_consumer_key'] = $_POST['oauth_consumer_key']; + $_SESSION['OAuth_consumer_secret'] = $_POST['oauth_consumer_secret']; + + $oauth->set('scope', $_POST['oauth_scope']); + $_SESSION['OAuth_scope'] = $_POST['oauth_scope']; + + $_SESSION['OAuth_access_token_url'] = $_POST['oauth_access_token_url']; + $_SESSION['OAuth_access_token_method'] = $_POST['oauth_access_token_method']; + + $authRequest->addExtension($oauth); + } + + $url = $authRequest->getAuthorizeURL(); + + if (empty($_POST['debug'])) { + header("Location: $url"); + exit; + } + +} else { + if (isset($_SESSION['identifier'])) { + $usid = $_SESSION['identifier']; + unset($_SESSION['identifier']); + } else { + $usid = null; + } + + unset($_SESSION['disable_associations']); + + if (!count($_POST)) { + list(, $queryString) = explode('?', $_SERVER['REQUEST_URI']); + } else { + // I hate php sometimes + $queryString = file_get_contents('php://input'); + } + + $message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP); + $id = $message->get('openid.claimed_id'); + $mode = $message->get('openid.mode'); + + try { + $result = $o->verify(new Net_URL2($returnTo . '?' . $queryString), + $message); + + if ($result->success()) { + $status = "Status:SUCCESS!"; + $status .= " ({$result->getAssertionMethod()})"; + } else { + $status = "Status:FAIL!"; + $status .= " ({$result->getAssertionMethod()})"; + } + } catch (OpenID_Exception $e) { + $status = "Status:EXCEPTION!"; + $status .= " ({$e->getMessage()} : {$e->getCode()})"; + } + + // OAuth hyprid fetching access token + if (isset($_SESSION['OAuth_consumer_key'], + $_SESSION['OAuth_consumer_secret'], + $_SESSION['OAuth_access_token_url'], + $_SESSION['OAuth_access_token_method'])) { + + try { + $oauth = new OpenID_Extension_OAuth(OpenID_Extension::RESPONSE, + $message); + + // Fix line lengths. + $consumerKey = $_SESSION['OAuth_consumer_key']; + $consumerSecret = $_SESSION['OAuth_consumer_key']; + $tokenURL = $_SESSION['OAuth_access_token_url']; + $tokenMethod = $_SESSION['OAuth_access_token_method']; + + $oauthData = $oauth->getAccessToken($consumerKey, + $consumerSecret, + $tokenURL, + array(), + $tokenMethod); + + } catch (Exception $e) { + } + } + + $contents = "
    +

    + + + + + + $status\n + "; + + foreach ($message->getArrayFormat() as $key => $value) { + $contents .= "\n"; + } + + if (isset($oauthData) && count($oauthData)) { + $contents .= ""; + $contents .= " "; + $contents .= ""; + + foreach ($oauthData as $key => $value) { + $contents .= "\n"; + } + } + + $contents .= "
    Results
    User Supplied Identifier:$usid
    Claimed Identifier:$id
    Mode:$mode


    Message Contents

    $key$value


    OAuth Access token/secret

    $key$value
    "; + $contents .= "

    "; + + $openid = $message->getArrayFormat(); + if ($GLOBALS['phorkie']['auth']['secure'] > 0 && + $GLOBALS['phorkie']['auth']['userlist']) { + if (!in_array($openid['openid.identity'], $GLOBALS['phorkie']['users'])) { + $redirect = 'http://' . $_SERVER['HTTP_HOST'] . "/forbidden"; + header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL)); + exit; + } + } + // include_once 'openid/wrapper.php'; + + $email = (isset($openid['openid.ext1.value.email'])) ? $openid['openid.ext1.value.email'] : null; + $email = (isset($openid['openid.ext2.value.email']) && !isset($email)) ? $openid['openid.ext2.value.email'] : $email; + $email = (isset($openid['openid.sreg.email']) && !isset($email)) ? $openid['openid.sreg.email'] : $email; + $email = (isset($openid['openid.ax.value.email']) && !isset($email)) ? $openid['openid.ax.value.email'] : $email; + $_SESSION['email'] = (isset($email)) ? $email : $GLOBALS['phorkie']['auth']['anonymousEmail']; + + $name = (isset($openid['openid.ext1.value.firstname']) && isset($openid['openid.ext1.value.lastname'])) ? $openid['openid.ext1.value.firstname']." ".$openid['openid.ext1.value.lastname'] : null; + $name = (isset($openid['openid.sreg.firstname']) && isset($openid['openid.sreg.lastname']) && !isset($name)) ? $openid['openid.sreg.firstname']." ".$openid['openid.sreg.lastname'] : $name; + $name = (isset($openid['openid.sreg.nickname']) && !isset($name)) ? $openid['openid.sreg.nickname'] : $name; + $_SESSION['name'] = (isset($name)) ? $name : $_SERVER['REMOTE_ADDR']; + + $_SESSION['identity'] = $openid['openid.identity']; + + $redirect = 'http://' . $_SERVER['HTTP_HOST'] . $_SESSION['REQUEST_URI']; + header('Location: ' . filter_var($redirect, FILTER_SANITIZE_URL)); +} + +?> diff --git a/www/css/debug.css b/www/css/debug.css new file mode 100644 index 0000000..634243a --- /dev/null +++ b/www/css/debug.css @@ -0,0 +1,85 @@ +html, body { + background: #ededed; + font: 82.5% Helvetica Neue, HelveticaNeue, Helvetica, sans-serif; + margin: 30px 0 0; padding: 0px; } + +h3 { + color: #aaa; + margin: 0; padding: 0; + font-size: 1.3em; + + position: absolute; + top: 30px; + width: 100%; + text-align: center; + left: 0; +} + +h3 a { + color: #111; + text-decoration: none; +} + +h3 a:hover { + text-decoration: underline; + +} + +form { + padding: 30px; + background: #fff; + -moz-border-radius: 6px; + -webkit-border-radius: 6px; + width: 400px; + margin: 50px auto 0; + } + +table { + font-size: 1.1em !important; + font-weight: bold; +} + +td { + width: 200px; +} +.discover_results { + margin: 60px 0 ; + padding: 30px; + background: #111; + text-align: center; +} + + +.discover_results b { + color: #fff; + font-size: 2.4em; +} + +.relyingparty_results { + width: 100%; +} + +.relyingparty_results table b { + display: block; + width: 300px; + font-size: 1.7em; + color: #fff; +} + + +pre, .relyingparty_results p table { + font-size: 1.2em; + width: 900px !important; + text-align: left; + margin: 0 auto; + + color: #ddd; + padding: 30px; + +} + +.relyingparty_results { + background: #111; + padding: 30px; + margin: 60px 0; +} diff --git a/www/css/openid.css b/www/css/openid.css new file mode 100644 index 0000000..38988a7 --- /dev/null +++ b/www/css/openid.css @@ -0,0 +1,64 @@ +body { + font-family:"Helvetica Neue", Helvetica, Arial, sans-serif; +} +#openid_form { + width: 470px; +} +#openid_form legend { + font-weight: bold; +} +#openid_choice { + display: none; +} +#openid_input_area { + clear: both; +} +#openid_btns { + height: 66px; + margin-bottom: 10px; +} +#openid_btns br { + clear: both; +} +#openid_highlight { + padding: 3px; + background-color: #FFFCC9; + float: left; +} +#identifier { + margin: 0px !important; + width: 250px; + background: #FFF url(/images/openid-inputicon.gif) no-repeat scroll 0 50%; + padding-left:18px; +} +.openid_large_btn { + width: 100px; + height: 60px; + border: 1px solid #DDD; + margin: 3px; + float: left; +} +.openid_small_btn { + width: 24px; + height: 24px; + border: 1px solid #DDD; + margin: 3px; + float: left; +} +.google { + background: #FFF url(/images/google.gif) no-repeat center center; +} +.yahoo { + background: #FFF url(/images/yahoo.gif) no-repeat center center; +} + +a.openid_large_btn:hover { + outline: none; + border: 1px solid #030303; +} +a.openid_large_btn:focus { + -moz-outline-style: none; +} +.openid_selected { + border: 4px solid #DDD; +} diff --git a/www/delete.php b/www/delete.php index 6d68ae4..f332028 100644 --- a/www/delete.php +++ b/www/delete.php @@ -4,6 +4,9 @@ namespace phorkie; * Delete paste or ask for deletion */ require_once 'www-header.php'; +if ($GLOBALS['phorkie']['auth']['secure'] > 0) { + require_once 'secure.php'; +} $repo = new Repository(); $repo->loadFromRequest(); diff --git a/www/display.php b/www/display.php index c8df8a9..2376d30 100644 --- a/www/display.php +++ b/www/display.php @@ -4,6 +4,9 @@ namespace phorkie; * Display paste contents */ require_once 'www-header.php'; +if ($GLOBALS['phorkie']['auth']['secure'] == 2) { + require_once 'secure.php'; +} $repo = new Repository(); $repo->loadFromRequest(); diff --git a/www/edit.php b/www/edit.php index 562c97c..226b774 100644 --- a/www/edit.php +++ b/www/edit.php @@ -4,6 +4,9 @@ namespace phorkie; * Edit paste contents */ require_once 'www-header.php'; +if ($GLOBALS['phorkie']['auth']['secure'] > 0) { + require_once 'secure.php'; +} $repo = new Repository(); $repo->loadFromRequest(); diff --git a/www/forbidden.php b/www/forbidden.php new file mode 100644 index 0000000..e8fb7ec --- /dev/null +++ b/www/forbidden.php @@ -0,0 +1,11 @@ + diff --git a/www/fork.php b/www/fork.php index 7997632..cc2ed33 100644 --- a/www/fork.php +++ b/www/fork.php @@ -4,6 +4,9 @@ */ namespace phorkie; require_once 'www-header.php'; +if ($GLOBALS['phorkie']['auth']['secure'] > 0) { + require_once 'secure.php'; +} if ($_SERVER['REQUEST_METHOD'] !== 'POST') { throw new Exception_Input('Forking only possible via POST'); diff --git a/www/images/access_denied.png b/www/images/access_denied.png new file mode 100644 index 0000000..c13d7b9 Binary files /dev/null and b/www/images/access_denied.png differ diff --git a/www/images/google.gif b/www/images/google.gif new file mode 100644 index 0000000..1b6cd07 Binary files /dev/null and b/www/images/google.gif differ diff --git a/www/images/openid-inputicon.gif b/www/images/openid-inputicon.gif new file mode 100644 index 0000000..cde836c Binary files /dev/null and b/www/images/openid-inputicon.gif differ diff --git a/www/images/yahoo.gif b/www/images/yahoo.gif new file mode 100644 index 0000000..42adbfa Binary files /dev/null and b/www/images/yahoo.gif differ diff --git a/www/index.php b/www/index.php index 9a05add..7ac6fcf 100644 --- a/www/index.php +++ b/www/index.php @@ -1,4 +1,7 @@ diff --git a/www/new.php b/www/new.php index ef9daec..fc6d5f3 100644 --- a/www/new.php +++ b/www/new.php @@ -11,6 +11,9 @@ namespace phorkie; * Creates and redirects to display page */ require_once 'www-header.php'; +if ($GLOBALS['phorkie']['auth']['secure'] > 0) { + require_once 'secure.php'; +} $repopo = new Repository_Post(); if ($repopo->process($_POST)) { diff --git a/www/raw.php b/www/raw.php index 8bda11e..67a21ee 100644 --- a/www/raw.php +++ b/www/raw.php @@ -4,6 +4,9 @@ */ namespace phorkie; require_once 'www-header.php'; +if ($GLOBALS['phorkie']['auth']['secure'] == 2) { + require_once 'secure.php'; +} $repo = new Repository(); $repo->loadFromRequest(); diff --git a/www/revision.php b/www/revision.php index 53ac458..06462af 100644 --- a/www/revision.php +++ b/www/revision.php @@ -4,6 +4,9 @@ namespace phorkie; * Display paste contents */ require_once 'www-header.php'; +if ($GLOBALS['phorkie']['auth']['secure'] == 2) { + require_once 'secure.php'; +} $repo = new Repository(); $repo->loadFromRequest(); diff --git a/www/secure.php b/www/secure.php new file mode 100644 index 0000000..5893033 --- /dev/null +++ b/www/secure.php @@ -0,0 +1,11 @@ + diff --git a/www/www-header.php b/www/www-header.php index 72a2e67..3bb7e89 100644 --- a/www/www-header.php +++ b/www/www-header.php @@ -1,5 +1,6 @@ loadTemplate($tplname . '.htm');