Exponential Basic 2.4.0.1 Exponential Basic CMS — PHP Class Reference

authorize.php
Go to the documentation of this file.
1 <?php
17 $module = $Params['Module'];
18
19 // First check for mandatory parameters
20 $http = eZHTTPTool::instance();
21 $restINI = eZINI::instance( 'rest.ini' );
22
23 // Redirect URI, required to handle other errors, checked first
24 if ( ( $pRedirectUri = getHTTPVariable( 'redirect_uri' ) ) === false )
25 {
26 response( '400 Bad Request' );
27 }
28
29 // Client ID
30 if ( ( $pClientId = getHTTPVariable( 'client_id' ) ) === false )
31 {
32 error( $pRedirectUri, 'invalid_request', "Missing client ID parameter" );
33 // redirect to the redirect_uri with GET parameter error=invalid_request
34 // @todo mismatch between chapters 3.2's example (error=access-denied) and error codes list at 3.2.1 (error=access_denied)
35 }
36
37 // Requested response type
38 if ( ( $pResponseType = getHTTPVariable( 'response_type' ) ) === false )
39 {
40 error( $pRedirectUri, 'invalid_request', "Missing response_type parameter" );
41 // redirect to the redirect_uri with GET parameter error=invalid_request
42 // @todo mismatch between chapters 3.2's example (error=access-denied) and error codes list at 3.2.1 (error=access_denied)
43 }
44
45 // Scope
46 $pScope = getHTTPVariable( 'scope' );
47
48 // @todo The spec mentions (FIXME:chapter) throwing an error if the request has extra parameters. Check this.
49
50 // Try loading the REST client based on the ID
51 $application = ezpRestClient::fetchByClientId( $pClientId );
52 if ( !$application instanceof ezpRestClient )
53 {
54 error( $pRedirectUri, 'invalid_client' );
55 }
56
57 // The client is found, validate the redirect_uri
58 if ( !$application->isEndPointValid( $pRedirectUri ) )
59 {
60 error( $pRedirectUri, 'redirect_uri_mismatch' );
61 }
62
63 // authentication
64 $user = eZUser::currentUser();
65
66 // login is like REALLY required here. But we can't use the standard policy check, as it won't redirect w/ GET parameters
67 if ( !$user->isRegistered() )
68 {
69 $redirectUri = str_replace( eZSys::indexDir(), '', $_SERVER['REQUEST_URI'] );
70
71 $tpl = eZTemplate::factory();
72
73 $tpl->setVariable( 'redirect_uri', $redirectUri, 'User' );
74 $tpl->setVariable( 'site_access', array( 'allowed' => true ) );
75
76 $result = array();
77 $result['content'] = $tpl->fetch( 'design:user/login.tpl' );
78 $result['pagelayout'] = false;
79 $result['path'] = array( array( 'text' => ezpI18n::tr( 'kernel/user', 'User' ),
80 'url' => false ),
81 array( 'text' => ezpI18n::tr( 'kernel/user', 'Login' ),
82 'url' => false ) );
83 $result['pagelayout'] = 'oauthloginpagelayout.tpl';
84
85 return $result;
86 }
87 // logged in, but no access to oauth/authorize
88 $access = $user->hasAccessTo( 'oauth', 'authorize' );
89 if ( !$access[ 'accessWord' ] == 'yes' )
90 {
91 return $module->handleError( eZError::KERNEL_ACCESS_DENIED, 'kernel' );
92 }
93 unset( $access );
94
95 // Everything is valid. Process to app authorization.
96 if ( !$application->isAuthorizedByUser( $pScope, eZUser::currentUser() ) )
97 {
98 $http = eZHTTPTool::instance();
99
100 // authorization denied: redirect
101 if ( $http->hasPostVariable( 'DenyButton' ) )
102 {
103 error( $pRedirectUri, 'access_denied' );
104 }
105
106 elseif ( $http->hasPostVariable( 'AuthorizeButton' ) )
107 {
108 $application->authorizeFor( $user );
109 }
110
111 // show authorization form
112 if ( !$application->isAuthorizedByUser( $pScope, eZUser::currentUser() ) )
113 {
114 $tpl = eZTemplate::factory();
115
116 $tpl->setVariable( 'application', $application );
117 $tpl->setVariable( 'module', $module );
118
119 $parameters = array( 'client_id' => $pClientId,
120 'response_type' => $pResponseType,
121 'scope' => $pScope,
122 'redirect_uri' => $pRedirectUri );
123 $tpl->setVariable( 'httpParameters', $parameters );
124
125 $result = array();
126 $result['content'] = $tpl->fetch( 'design:oauth/authorize.tpl' );
127 $result['pagelayout'] = 'oauthloginpagelayout.tpl';
128 $result['path'] = array( array( 'text' => ezpI18n::tr( 'kernel/user', 'oAuth' ),
129 'url' => false ),
130 array( 'text' => ezpI18n::tr( 'kernel/user', 'authorization' ),
131 'url' => false ) );
132
133 return $result;
134 }
135 }
136
137 $tokenTTL = (int)$restINI->variable( 'OAuthSettings', 'TokenTTL' );
138 if ( $pResponseType == 'token')
139 {
140 // At this point, the we know the user HAS granted access, and can hand over a token
141 $rAccessToken = ezpRestToken::generateToken( $pScope );
142 $rRefreshToken = ezpRestToken::generateToken( $pScope );
143
144 $token = new ezpRestToken();
145 $token->id = $rAccessToken;
146 $token->refresh_token = $rRefreshToken;
147 $token->client_id = $pClientId;
148 $token->user_id = $user->attribute( 'contentobject_id' );
149 $token->expirytime = time() + $tokenTTL;
150
151 $session = ezcPersistentSessionInstance::get();
152 $session->save( $token );
153
154
155 // The user has a agreed to authorize this app.
156 // Redirect to the redirect_uri with these parameters:
157 // - code, only if request_type == code OR code_and_token @todo Implement
158 // - access_token, only if request_type == token OR code_and_token
159 // - expires_in, the token lifetime in seconds
160 // - scope, the permission scope the provided code / token grants, if different from the requested one (not implemented yet)
161 // - state, not implemented yet (state persistency related)
162 $parameters = array();
163
164 $rExpiresIn = $tokenTTL;
165
166 $parameters[] = 'access_token=' . urlencode( $rAccessToken );
167 $parameters[] = 'refresh_token=' . urlencode( $rRefreshToken );
168 $parameters[] = "expires_in=$rExpiresIn";
169 $location = "{$pRedirectUri}?" . implode( $parameters, '&' );
170
171 response( '302 Found', $location );
172 }
173 elseif ( $pResponseType == 'code')
174 {
175 // At this point, the we know the user HAS granted access, and can hand over a token
176 $rCode = ezpRestToken::generateToken( $pScope );
177
178 $code = new ezpRestAuthcode();
179 $code->id = $rCode;
180 $code->client_id = $pClientId;
181 $code->user_id = $user->attribute( 'contentobject_id' );
182 $code->expirytime = time() + $tokenTTL;
183
184 $session = ezcPersistentSessionInstance::get();
185 $session->save( $code );
186
187
188 // The user has a agreed to authorize this app.
189 // Redirect to the redirect_uri with these parameters:
190 // - code, only if request_type == code OR code_and_token @todo Implement
191 // - access_token, only if request_type == token OR code_and_token
192 // - expires_in, the token lifetime in seconds
193 // - scope, the permission scope the provided code / token grants, if different from the requested one (not implemented yet)
194 // - state, not implemented yet (state persistency related)
195 $parameters = array();
196
197 $rExpiresIn = $tokenTTL;
198
199 $parameters[] = 'code=' . urlencode( $rCode );
200 $parameters[] = "expires_in=$rExpiresIn";
201 $location = "{$pRedirectUri}?" . implode( $parameters, '&' );
202
203 response( '302 Found', $location );
204 }
205
215 function error( $redirectUri, $errorCode, $message = null )
216 {
217 $location = "{$redirectUri}?error=" . urlencode( $errorCode );
218 if( $message !== null )
219 $location .= '&error_description=' . urlencode( $message );
220 response( '302 Found', $location );
221 }
222
231 function response( $httpHeader, $location = null )
232 {
233 header( "HTTP/1.1 $httpHeader" );
234 if ( $location !== null )
235 // debug stuff: echo "header( \"Location: $location\" );\n";
236 header( "Location: $location" );
237 eZExecution::cleanExit();
238 }
239
247 function getHTTPVariable( $variable )
248 {
249 static $hasPost;
250 static $http;
251
252 if ( $http === null )
253 $http = eZHTTPTool::instance();
254
255 if ( $hasPost === null )
256 $hasPost = $http->hasPostVariable( 'AuthorizeButton' ) || $http->hasPostVariable( 'DenyButton' );
257
258 if ( $hasPost )
259 return $http->hasPostVariable( $variable ) ? $http->postVariable( $variable ) : false;
260 else
261 return $http->hasGetVariable( $variable ) ? $http->getVariable( $variable ) : false;
262 }
263 ?>
$session
$session
Definition: admin/articlelist.php:44
$message
$message
Definition: admin/message.php:51
response
response( $httpHeader, $location=null)
Definition: authorize.php:231
$pScope
if(( $pRedirectUri=getHTTPVariable( 'redirect_uri'))===false) if(( $pClientId=getHTTPVariable( 'client_id'))===false) if(( $pResponseType=getHTTPVariable( 'response_type'))===false) $pScope
Definition: authorize.php:46
$access
if(! $user->isRegistered()) $access
Definition: authorize.php:88
$application
$application
Definition: authorize.php:51
$restINI
$restINI
Definition: authorize.php:21
$http
$http
Definition: authorize.php:20
getHTTPVariable
getHTTPVariable( $variable)
Definition: authorize.php:247
$module
$module
Definition: authorize.php:17
$tokenTTL
if(! $application->isAuthorizedByUser( $pScope, eZUser::currentUser())) $tokenTTL
Definition: authorize.php:137
$user
if(! $application instanceof ezpRestClient) if(! $application->isEndPointValid( $pRedirectUri)) $user
Definition: authorize.php:64
error
if( $pResponseType=='token') elseif( $pResponseType=='code') error( $redirectUri, $errorCode, $message=null)
Definition: authorize.php:215
eZExecution\cleanExit
static cleanExit()
Definition: ezexecution.php:101
eZSys\indexDir
static indexDir( $withAccessList=true)
Definition: ezsys.php:594
eZUser\currentUser
static & currentUser()
Definition: ezuser.php:896
ezpRestAuthcode
Definition: ezprest_authcode.php:17
ezpRestClient
Definition: restclient.php:16
ezpRestClient\attribute
attribute( $attributeName)
Definition: restclient.php:102
ezpRestClient\fetchByClientId
static fetchByClientId( $clientId)
Definition: restclient.php:195
ezpRestToken
Definition: ezprest_token.php:17
ezpRestToken\generateToken
static generateToken( $vary)
Definition: ezprest_token.php:93
$result
$result
Definition: companysearch.php:94
$tpl
$tpl
Definition: mailtofriend.php:58
$location
$location
Definition: user/gotolink.php:43
Copyright © 1998 – 2026 7x. All rights reserved. Licensed under the GNU GPLv2+.