eliseuamaro/gnu-social
1
0
Fork 0
forked from GNUsocial/gnu-social
Code Issues Pull Requests Releases Wiki Activity

add basic auth support for cgi servers on the api (trac #1832)

Browse Source
This commit is contained in:
mEDI 2009-09-03 19:32:27 +02:00 committed by Craig Andrews
parent 0c95734a68
commit 0d7d4dfe5d
1 changed files with 41 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
actions/api.php
View File

@ -27,6 +27,8 @@ class ApiAction extends Action
var $api_arg;
var $api_method;
var $api_action;
var $auth_user;
var $auth_pw;
function handle($args)
{
@ -35,6 +37,7 @@ class ApiAction extends Action
$this->api_action = $this->arg('apiaction');
$method = $this->arg('method');
$argument = $this->arg('argument');
$this->basic_auth_process_header();
if (isset($argument)) {
$cmdext = explode('.', $argument);
@ -50,7 +53,7 @@ class ApiAction extends Action
}
if ($this->requires_auth()) {
if (!isset($_SERVER['PHP_AUTH_USER'])) {
if (!isset($this->auth_user)) {
# This header makes basic auth go
header('WWW-Authenticate: Basic realm="StatusNet API"');
@ -58,8 +61,8 @@ class ApiAction extends Action
# If the user hits cancel -- bam!
$this->show_basic_auth_error();
} else {
$nickname = $_SERVER['PHP_AUTH_USER'];
$password = $_SERVER['PHP_AUTH_PW'];
$nickname = $this->auth_user;
$password = $this->auth_pw;
$user = common_check_user($nickname, $password);
if ($user) {
@ -76,8 +79,8 @@ class ApiAction extends Action
} else {
// Caller might give us a username even if not required
if (isset($_SERVER['PHP_AUTH_USER'])) {
$user = User::staticGet('nickname', $_SERVER['PHP_AUTH_USER']);
if (isset($this->auth_user)) {
$user = User::staticGet('nickname', $this->auth_user);
if ($user) {
$this->user = $user;
}
@ -203,6 +206,39 @@ class ApiAction extends Action
}
}
function basic_auth_process_header()
{
if(isset($_SERVER['AUTHORIZATION']) || isset($_SERVER['HTTP_AUTHORIZATION']))
{
$authorization_header = isset($_SERVER['HTTP_AUTHORIZATION'])?$_SERVER['HTTP_AUTHORIZATION']:$_SERVER['AUTHORIZATION'];
}
if(isset($_SERVER['PHP_AUTH_USER']))
{
$this->auth_user = $_SERVER['PHP_AUTH_USER'];
$this->auth_pw = $_SERVER['PHP_AUTH_PW'];
}
elseif ( isset($authorization_header) && strstr(substr($authorization_header, 0,5),'Basic') )
{
// decode the HTTP_AUTHORIZATION header on php-cgi server self
// on fcgid server is the header name AUTHORIZATION
$auth_hash = base64_decode( substr($authorization_header, 6) );
list($this->auth_user, $this->auth_pw) = explode(':', $auth_hash);
// set all to NULL on a emty basic auth request
if($this->auth_user == "") {
$this->auth_user = NULL;
$this->auth_pw = NULL;
}
}
else
{
$this->auth_user = NULL;
$this->auth_pw = NULL;
}
}
function show_basic_auth_error()
{
header('HTTP/1.1 401 Unauthorized');