GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

OAuth: Fix rare problem in which request tokens were sometimes being

Browse Source 
returned as access tokens.
This commit is contained in:
Zach Copley 2011-01-19 22:55:00 -08:00
parent 28d40e5eed
commit 05361bb686
2 changed files with 141 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
actions/apioauthaccesstoken.php
View File

@ -84,6 +84,7 @@ class ApiOauthAccessTokenAction extends ApiOauthAction
common_debug(var_export($req, true)); common_debug(var_export($req, true));
$code = $e->getCode(); $code = $e->getCode();
$this->clientError($e->getMessage(), empty($code) ? 401 : $code, 'text'); $this->clientError($e->getMessage(), empty($code) ? 401 : $code, 'text');
return;
} }
if (empty($atok)) { if (empty($atok)) {

194
lib/apioauthstore.php
View File

@ -152,8 +152,11 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
); );
} }
// check to see if we have previously issued an access token for this application // Check to see if we have previously issued an access token for
// and profile // this application and profile; if so we can just return the
// existing access token. That seems to be the best practice. It
// makes it so users only have to authorize the app once per
// machine.
$appUser = new Oauth_application_user(); $appUser = new Oauth_application_user();
@ -172,19 +175,40 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
) )
); );
$at = new Token(); $at = null;
// fetch the full access token // Special case: we used to store request tokens in the
$at->consumer_key = $consumer->key; // Oauth_application_user record, and the access_type would
$at->tok = $appUser->token; // always be 0 (no access) as a failsafe until an access
// token was issued and replaced the request token. There could
// be a few old Oauth_application_user records storing request
// tokens still around, and we don't want to accidentally
// return a useless request token instead of a new access
// token. So if we find one, we generate a new access token
// and update the existing Oauth_application_user record before
// returning the new access token. This should be rare.
$result = $at->find(true); if ($appUser->access_type == 0) {
if (!$result) { $at = $this->generateNewAccessToken($consumer, $rt, $verifier);
throw new Exception( $this->updateAppUser($appUser, $app, $at);
// TRANS: Exception thrown when no access token can be issued.
_('Could not issue access token.') } else {
);
$at = new Token();
// fetch the full access token
$at->consumer_key = $consumer->key;
$at->tok = $appUser->token;
$result = $at->find(true);
if (!$result) {
throw new Exception(
// TRANS: Exception thrown when no access token can be issued.
_('Could not issue access token.')
);
}
} }
// Yay, we can re-issue the access token // Yay, we can re-issue the access token
@ -200,48 +224,8 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
) )
); );
// make a brand new access token $at = $this->generateNewAccessToken($consumer, $rt, $verifier);
$at = new Token(); $this->newAppUser($tokenAssoc, $app, $at);
$at->consumer_key = $consumer->key;
$at->tok = common_good_rand(16);
$at->secret = common_good_rand(16);
$at->type = 1; // access
$at->verifier = $verifier;
$at->verified_callback = $rt->verified_callback; // 1.0a
$at->created = common_sql_now();
if (!$at->insert()) {
$e = $at->_lastError;
common_debug('access token "' . $at->tok . '" not inserted: "' . $e->message . '"', __FILE__);
return null;
} else {
common_debug('access token "' . $at->tok . '" inserted', __FILE__);
// burn the old one
$orig_rt = clone($rt);
$rt->state = 2; // used
if (!$rt->update($orig_rt)) {
return null;
}
common_debug('request token "' . $rt->tok . '" updated', __FILE__);
}
// insert a new Oauth_application_user record w/access token
$appUser = new Oauth_application_user();
$appUser->profile_id = $tokenAssoc->profile_id;
$appUser->application_id = $app->id;
$appUser->access_type = $app->access_type;
$appUser->token = $at->tok;
$appUser->created = common_sql_now();
$result = $appUser->insert();
if (!$result) {
common_log_db_error($appUser, 'INSERT', __FILE__);
// TRANS: Server error displayed when a database error occurs.
$this->serverError(_('Database error inserting OAuth application user.'));
}
// Okay, good // Okay, good
return new OAuthToken($at->tok, $at->secret); return new OAuthToken($at->tok, $at->secret);
@ -261,6 +245,108 @@ class ApiStatusNetOAuthDataStore extends StatusNetOAuthDataStore
} }
} }
/*
* Generate a new access token and save it to the database
*
* @param Consumer $consumer the OAuth consumer
* @param Token $rt the authorized request token
* @param string $verifier the OAuth 1.0a verifier
*
* @access private
*
* @return Token $at the new access token
*/
private function generateNewAccessToken($consumer, $rt, $verifier)
{
$at = new Token();
$at->consumer_key = $consumer->key;
$at->tok = common_good_rand(16);
$at->secret = common_good_rand(16);
$at->type = 1; // access
$at->verifier = $verifier;
$at->verified_callback = $rt->verified_callback; // 1.0a
$at->created = common_sql_now();
if (!$at->insert()) {
$e = $at->_lastError;
common_debug('access token "' . $at->tok . '" not inserted: "' . $e->message . '"', __FILE__);
return null;
} else {
common_debug('access token "' . $at->tok . '" inserted', __FILE__);
// burn the old one
$orig_rt = clone($rt);
$rt->state = 2; // used
if (!$rt->update($orig_rt)) {
return null;
}
common_debug('request token "' . $rt->tok . '" updated', __FILE__);
}
return $at;
}
/*
* Add a new app user (Oauth_application_user) record
*
* @param Oauth_token_association $tokenAssoc token-to-app association
* @param Oauth_application $app the OAuth client app
* @param Token $at the access token
*
* @access private
*
* @return void
*/
private function newAppUser($tokenAssoc, $app, $at)
{
$appUser = new Oauth_application_user();
$appUser->profile_id = $tokenAssoc->profile_id;
$appUser->application_id = $app->id;
$appUser->access_type = $app->access_type;
$appUser->token = $at->tok;
$appUser->created = common_sql_now();
$result = $appUser->insert();
if (!$result) {
common_log_db_error($appUser, 'INSERT', __FILE__);
// TRANS: Server error displayed when a database error occurs.
throw new Exception(
_('Database error inserting OAuth application user.')
);
}
}
/*
* Update an existing app user (Oauth_application_user) record
*
* @param Oauth_application_user $appUser existing app user rec
* @param Oauth_application $app the OAuth client app
* @param Token $at the access token
*
* @access private
*
* @return void
*/
private function updateAppUser($appUser, $app, $at)
{
$original = clone($appUser);
$appUser->access_type = $app->access_type;
$appUser->token = $at->tok;
$result = $appUser->update($original);
if (!$result) {
common_log_db_error($appUser, 'UPDATE', __FILE__);
// TRANS: Server error displayed when a database error occurs.
throw new Exception(
_('Database error updating OAuth application user.')
);
}
}
/** /**
* Revoke specified access token * Revoke specified access token
* *