sydney/IPB
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 5.0.0 beta 1

Browse Source
This commit is contained in:
Neo committed 2025-12-19 16:27:35 -08:00
1 parent 25ddeb65d6
commit 15c7beabc5
6736 files changed
+627902 -497943
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

system/Login/Handler/OAuth1/OAuth1.php
+120 -95
View File
@@ -12,38 +12,58 @@
namespace IPS\Login\Handler;
/* To prevent PHP errors (extending class does not exist) revealing path */
if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
use DomainException;
use IPS\Db;
use IPS\Helpers\Form\Radio;
use IPS\Helpers\Form\Text;
use IPS\Http\Response;
use IPS\Http\Url;
use IPS\Log;
use IPS\Login;
use IPS\Login\Exception;
use IPS\Login\Handler;
use IPS\Member;
use IPS\Output;
use IPS\Request;
use IPS\Session;
use LogicException;
use RuntimeException;
use UnderflowException;
use function count;
use function defined;
if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
{
header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
header( ( $_SERVER['SERVER_PROTOCOL'] ?? 'HTTP/1.0' ) . ' 403 Forbidden' );
exit;
}
/**
* Abstract OAuth1 Login Handler
*/
abstract class _OAuth1 extends \IPS\Login\Handler
abstract class OAuth1 extends Handler
{
/* !Login Handler: Basics */
/**
* ACP Settings Form
*
* @param string $url URL to redirect user to after successful submission
* @return array List of settings to save - settings will be stored to core_login_methods.login_settings DB field
* @code
return array( 'savekey' => new \IPS\Helpers\Form\[Type]( ... ), ... );
* @endcode
*/
public function acpForm()
public function acpForm(): array
{
$return = array(
array( 'login_handler_oauth_settings', \IPS\Member::loggedIn()->language()->addToStack( static::getTitle() . '_info', FALSE, array( 'sprintf' => array( (string) $this->redirectionEndpoint() ) ) ) ),
'consumer_key' => new \IPS\Helpers\Form\Text( 'oauth_consumer_key', ( isset( $this->settings['consumer_key'] ) ) ? $this->settings['consumer_key'] : '', TRUE ),
'consumer_secret' => new \IPS\Helpers\Form\Text( 'oauth_consumer_secret', ( isset( $this->settings['consumer_secret'] ) ) ? $this->settings['consumer_secret'] : '', TRUE ),
array( 'login_handler_oauth_settings', Member::loggedIn()->language()->addToStack( static::getTitle() . '_info', FALSE, array( 'sprintf' => array( (string) $this->redirectionEndpoint() ) ) ) ),
'consumer_key' => new Text( 'oauth_consumer_key', ( isset( $this->settings['consumer_key'] ) ) ? $this->settings['consumer_key'] : '', TRUE ),
'consumer_secret' => new Text( 'oauth_consumer_secret', ( isset( $this->settings['consumer_secret'] ) ) ? $this->settings['consumer_secret'] : '', TRUE ),
);
$return[] = 'account_management_settings';
$return['show_in_ucp'] = new \IPS\Helpers\Form\Radio( 'login_handler_show_in_ucp', isset( $this->settings['show_in_ucp'] ) ? $this->settings['show_in_ucp'] : 'always', FALSE, array(
$return['show_in_ucp'] = new Radio( 'login_handler_show_in_ucp', $this->settings['show_in_ucp'] ?? 'always', FALSE, array(
'options' => array(
'always' => 'login_handler_show_in_ucp_always',
'loggedin' => 'login_handler_show_in_ucp_loggedin',
@@ -55,9 +75,9 @@ abstract class _OAuth1 extends \IPS\Login\Handler
if ( $forceNameHandler = static::handlerHasForceSync( 'name', $this ) )
{
$nameChangesDisabled[] = 'force';
\IPS\Member::loggedIn()->language()->words['login_update_changes_yes_name_desc'] = \IPS\Member::loggedIn()->language()->addToStack( 'login_update_changes_yes_disabled', FALSE, array( 'sprintf' => $forceNameHandler->_title ) );
Member::loggedIn()->language()->words['login_update_changes_yes_name_desc'] = Member::loggedIn()->language()->addToStack( 'login_update_changes_yes_disabled', FALSE, array( 'sprintf' => $forceNameHandler->_title ) );
}
$return['update_name_changes'] = new \IPS\Helpers\Form\Radio( 'login_update_name_changes', isset( $this->settings['update_name_changes'] ) ? $this->settings['update_name_changes'] : 'disabled', FALSE, array( 'options' => array(
$return['update_name_changes'] = new Radio( 'login_update_name_changes', $this->settings['update_name_changes'] ?? 'disabled', FALSE, array( 'options' => array(
'force' => 'login_update_changes_yes_name',
'optional' => 'login_update_changes_optional',
'disabled' => 'login_update_changes_no',
@@ -67,9 +87,9 @@ abstract class _OAuth1 extends \IPS\Login\Handler
if ( $forceEmailHandler = static::handlerHasForceSync( 'email', $this ) )
{
$emailChangesDisabled[] = 'force';
\IPS\Member::loggedIn()->language()->words['login_update_changes_yes_email_desc'] = \IPS\Member::loggedIn()->language()->addToStack( 'login_update_changes_yes_disabled', FALSE, array( 'sprintf' => $forceEmailHandler->_title ) );
Member::loggedIn()->language()->words['login_update_changes_yes_email_desc'] = Member::loggedIn()->language()->addToStack( 'login_update_changes_yes_disabled', FALSE, array( 'sprintf' => $forceEmailHandler->_title ) );
}
$return['update_email_changes'] = new \IPS\Helpers\Form\Radio( 'login_update_email_changes', isset( $this->settings['update_email_changes'] ) ? $this->settings['update_email_changes'] : 'optional', FALSE, array( 'options' => array(
$return['update_email_changes'] = new Radio( 'login_update_email_changes', $this->settings['update_email_changes'] ?? 'optional', FALSE, array( 'options' => array(
'force' => 'login_update_changes_yes_email',
'optional' => 'login_update_changes_optional',
'disabled' => 'login_update_changes_no',
@@ -82,9 +102,9 @@ abstract class _OAuth1 extends \IPS\Login\Handler
* Test Settings
*
* @return bool
* @throws \LogicException
* @throws LogicException
*/
public function testSettings()
public function testSettings(): bool
{
try
{
@@ -92,7 +112,7 @@ abstract class _OAuth1 extends \IPS\Login\Handler
}
catch ( \Exception $e )
{
throw new \LogicException( \IPS\Member::loggedIn()->language()->addToStack( 'oauth1_setup_error', FALSE, array( 'sprintf' => array( $e->getMessage() ) ) ) );
throw new LogicException( Member::loggedIn()->language()->addToStack( 'oauth1_setup_error', FALSE, array( 'sprintf' => array( $e->getMessage() ) ) ) );
}
try
@@ -101,28 +121,30 @@ abstract class _OAuth1 extends \IPS\Login\Handler
}
catch ( \Exception $e )
{
throw new \LogicException( \IPS\Member::loggedIn()->language()->addToStack( 'oauth1_setup_error', FALSE, array( 'sprintf' => array( (string) $response ) ) ) );
throw new LogicException( Member::loggedIn()->language()->addToStack( 'oauth1_setup_error', FALSE, array( 'sprintf' => array( (string) $response ) ) ) );
}
return true;
}
/* !Authentication */
use \IPS\Login\Handler\ButtonHandler;
use ButtonHandler;
/**
* Authenticate
*
* @param \IPS\Login $login The login object
* @return \IPS\Member
* @throws \IPS\Login\Exception
* @param Login $login The login object
* @return Member|null
* @throws Exception
*/
public function authenticateButton( \IPS\Login $login )
public function authenticateButton( Login $login ) : ?Member
{
if ( isset( \IPS\Request::i()->denied ) )
if ( isset( Request::i()->denied ) )
{
return NULL;
}
elseif ( isset( \IPS\Request::i()->oauth_token ) )
elseif ( isset( Request::i()->oauth_token ) )
{
return $this->_handleAuthorizationResponse( $login );
}
@@ -130,17 +152,19 @@ abstract class _OAuth1 extends \IPS\Login\Handler
{
$this->_redirectToAuthorizationEndpoint( $login );
}
return null;
}
/**
* Redirect to Resource Owner Authorization Endpoint
*
* @param \IPS\Login $login The login object
* @param Login $login The login object
* @return void
*/
protected function _redirectToAuthorizationEndpoint( \IPS\Login $login )
protected function _redirectToAuthorizationEndpoint( Login $login ) : void
{
$callback = $this->redirectionEndpoint()->setQueryString( 'state' , $this->id . '-' . base64_encode( $login->url ) . '-' . \IPS\Session::i()->csrfKey . '-' . \IPS\Request::i()->ref );
$callback = $this->redirectionEndpoint()->setQueryString( 'state' , $this->id . '-' . base64_encode( $login->url ) . '-' . Session::i()->csrfKey . '-' . Request::i()->ref );
try
{
@@ -148,31 +172,31 @@ abstract class _OAuth1 extends \IPS\Login\Handler
}
catch ( \Exception $e )
{
\IPS\Log::log( $e, 'twitter' );
throw new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::INTERNAL_ERROR );
Log::log( $e, 'twitter' );
throw new Exception( 'generic_error', Exception::INTERNAL_ERROR );
}
\IPS\Output::i()->redirect( $this->authorizationEndpoint( $login )->setQueryString( 'oauth_token', $response['oauth_token'] ) );
Output::i()->redirect( $this->authorizationEndpoint( $login )->setQueryString( 'oauth_token', $response['oauth_token'] ) );
}
/**
* Handle authorization response
*
* @param \IPS\Login $login The login object
* @return \IPS\Member
* @throws \IPS\Login\Exception
* @param Login $login The login object
* @return Member
* @throws Exception
*/
protected function _handleAuthorizationResponse( \IPS\Login $login )
protected function _handleAuthorizationResponse( Login $login ): Member
{
/* Authenticate */
try
{
$response = $this->_sendRequest( 'post', $this->accessTokenEndpoint(), array( 'oauth_verifier' => \IPS\Request::i()->oauth_verifier ), \IPS\Request::i()->oauth_token )->decodeQueryString('oauth_token');
$response = $this->_sendRequest( 'post', $this->accessTokenEndpoint(), array( 'oauth_verifier' => Request::i()->oauth_verifier ), Request::i()->oauth_token )->decodeQueryString('oauth_token');
}
catch ( \Exception $e )
{
\IPS\Log::log( $e, 'twitter' );
throw new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::INTERNAL_ERROR );
Log::log( $e, 'twitter' );
throw new Exception( 'generic_error', Exception::INTERNAL_ERROR );
}
/* Get user id */
@@ -182,25 +206,25 @@ abstract class _OAuth1 extends \IPS\Login\Handler
}
catch ( \Exception $e )
{
\IPS\Log::log( $e, 'oauth' );
throw new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::INTERNAL_ERROR );
Log::log( $e, 'oauth' );
throw new Exception( 'generic_error', Exception::INTERNAL_ERROR );
}
/* Has this user signed in with this service before? */
try
{
$oauthAccess = \IPS\Db::i()->select( '*', 'core_login_links', array( 'token_login_method=? AND token_identifier=?', $this->id, $userId ) )->first();
$member = \IPS\Member::load( $oauthAccess['token_member'] );
$oauthAccess = Db::i()->select( '*', 'core_login_links', array( 'token_login_method=? AND token_identifier=?', $this->id, $userId ) )->first();
$member = Member::load( $oauthAccess['token_member'] );
/* If the user never finished the linking process, or the account has been deleted, discard this access token */
if ( !$oauthAccess['token_linked'] or !$member->member_id )
{
\IPS\Db::i()->delete( 'core_login_links', array( 'token_login_method=? AND token_member=?', $this->id, $oauthAccess['token_member'] ) );
throw new \UnderflowException;
Db::i()->delete( 'core_login_links', array( 'token_login_method=? AND token_member=?', $this->id, $oauthAccess['token_member'] ) );
throw new UnderflowException;
}
/* Otherwise, update our token... */
\IPS\Db::i()->update( 'core_login_links', array(
Db::i()->update( 'core_login_links', array(
'token_access_token' => $response['oauth_token'],
'token_secret' => $response['oauth_token_secret'],
), array( 'token_login_method=? AND token_member=?', $this->id, $oauthAccess['token_member'] ) );
@@ -209,7 +233,7 @@ abstract class _OAuth1 extends \IPS\Login\Handler
return $member;
}
/* No, create or link the account */
catch ( \UnderflowException $e )
catch ( UnderflowException $e )
{
/* Get the username + email */
$name = NULL;
@@ -227,9 +251,9 @@ abstract class _OAuth1 extends \IPS\Login\Handler
try
{
if ( $login->type === \IPS\Login::LOGIN_UCP )
if ( $login->type === Login::LOGIN_UCP )
{
$exception = new \IPS\Login\Exception( 'generic_error', \IPS\Login\Exception::MERGE_SOCIAL_ACCOUNT );
$exception = new Exception( 'generic_error', Exception::MERGE_SOCIAL_ACCOUNT );
$exception->handler = $this;
$exception->member = $login->reauthenticateAs;
throw $exception;
@@ -237,7 +261,7 @@ abstract class _OAuth1 extends \IPS\Login\Handler
$member = $this->createAccount( $name, $email );
\IPS\Db::i()->insert( 'core_login_links', array(
Db::i()->insert( 'core_login_links', array(
'token_login_method' => $this->id,
'token_member' => $member->member_id,
'token_identifier' => $userId,
@@ -268,23 +292,23 @@ abstract class _OAuth1 extends \IPS\Login\Handler
return $member;
}
catch ( \IPS\Login\Exception $exception )
catch ( Exception $exception )
{
if ( $exception->getCode() === \IPS\Login\Exception::MERGE_SOCIAL_ACCOUNT )
if ( $exception->getCode() === Exception::MERGE_SOCIAL_ACCOUNT )
{
try
{
$identifier = \IPS\Db::i()->select( 'token_identifier', 'core_login_links', array( 'token_login_method=? AND token_member=?', $this->id, $exception->member->member_id ) )->first();
$identifier = Db::i()->select( 'token_identifier', 'core_login_links', array( 'token_login_method=? AND token_member=?', $this->id, $exception->member->member_id ) )->first();
if( $identifier != $userId )
{
$exception->setCode( \IPS\Login\Exception::LOCAL_ACCOUNT_ALREADY_MERGED );
$exception->setCode( Exception::LOCAL_ACCOUNT_ALREADY_MERGED );
throw $exception;
}
}
catch( \UnderflowException $e )
catch( UnderflowException $e )
{
\IPS\Db::i()->insert( 'core_login_links', array(
Db::i()->insert( 'core_login_links', array(
'token_login_method' => $this->id,
'token_member' => $exception->member->member_id,
'token_identifier' => $userId,
@@ -303,53 +327,54 @@ abstract class _OAuth1 extends \IPS\Login\Handler
/**
* Authorization Endpoint
*
* @param \IPS\Login $login The login object
* @return \IPS\Http\Url
* @param Login $login The login object
* @return Url
*/
abstract protected function authorizationEndpoint( \IPS\Login $login );
abstract protected function authorizationEndpoint( Login $login ): Url;
/**
* Token Request Endpoint
*
* @return \IPS\Http\Url
* @return Url
*/
abstract protected function tokenRequestEndpoint();
abstract protected function tokenRequestEndpoint(): Url;
/**
* Access Token Endpoint
*
* @return \IPS\Http\Url
* @return Url
*/
abstract protected function accessTokenEndpoint();
abstract protected function accessTokenEndpoint(): Url;
/**
* Redirection Endpoint
*
* @return \IPS\Http\Url
* @return Url
*/
public function redirectionEndpoint()
public function redirectionEndpoint(): Url
{
return \IPS\Http\Url::internal( 'oauth/callback/', 'none' );
return Url::internal( 'oauth/callback/', 'none' );
}
/**
* Send Request
*
* @param string $method HTTP Method
* @param \IPS\Http\Url $url URL
* @param array|string|NULL $params Parameters
* @param string $token OAuth Token
* @param array $otherParams Other params to send obvs
* @param string $mimeBoundary Mime data to send (boundary => data )
* @return \IPS\Http\Response
* @param string $method HTTP Method
* @param Url $url URL
* @param array|string|null $params Parameters
* @param string $token OAuth Token
* @param string $secret OAuth Secret
* @param array $otherParams Other params to send obvs
* @param array|string $mimeBoundary Mime data to send (boundary => data )
* @return Response
* @throws \IPS\Http\Request\Exception
*/
protected function _sendRequest( $method, $url, $params=array(), $token='', $secret='', $otherParams=array(), $mimeBoundary=array() )
protected function _sendRequest( string $method, Url $url, array|string|null $params=array(), string $token='', string $secret='', array $otherParams=array(), array|string $mimeBoundary=array() ): Response
{
/* Generate the OAUTH Authorization Header */
$OAuthAuthorization = array_merge( array(
'oauth_consumer_key' => $this->settings['consumer_key'],
'oauth_nonce' => md5( \IPS\Login::generateRandomString() ),
'oauth_nonce' => md5( Login::generateRandomString() ),
'oauth_signature_method'=> 'HMAC-SHA1',
'oauth_timestamp' => time(),
'oauth_token' => $token,
@@ -392,7 +417,7 @@ abstract class _OAuth1 extends \IPS\Login\Handler
$headers = array( 'Authorization' => $OAuthAuthorizationHeader );
/* Send the request */
if ( ! \count( $mimeBoundary ) )
if ( ! count( $mimeBoundary ) )
{
if ( $method === 'get' )
{
@@ -415,17 +440,17 @@ abstract class _OAuth1 extends \IPS\Login\Handler
* Get user's identifier (may not be a number)
* May return NULL if server doesn't support this
*
* @param \IPS\Member $member Member
* @param Member $member Member
* @return string|NULL
* @throws \IPS\Login\Exception The token is invalid and the user needs to reauthenticate
* @throws \DomainException General error where it is safe to show a message to the user
* @throws \RuntimeException Unexpected error from service
* @throws Exception The token is invalid and the user needs to reauthenticate
* @throws DomainException General error where it is safe to show a message to the user
* @throws RuntimeException Unexpected error from service
*/
public function userId( \IPS\Member $member )
public function userId( Member $member ): ?string
{
if ( !( $link = $this->_link( $member ) ) )
{
throw new \IPS\Login\Exception( $error['message'], \IPS\Login\Exception::INTERNAL_ERROR );
throw new Exception( "", Exception::INTERNAL_ERROR );
}
return $this->authenticatedUserId( $link['token_access_token'], $link['token_secret'] );
@@ -435,17 +460,17 @@ abstract class _OAuth1 extends \IPS\Login\Handler
* Get user's profile name
* May return NULL if server doesn't support this
*
* @param \IPS\Member $member Member
* @param Member $member Member
* @return string|NULL
* @throws \IPS\Login\Exception The token is invalid and the user needs to reauthenticate
* @throws \DomainException General error where it is safe to show a message to the user
* @throws \RuntimeException Unexpected error from service
* @throws Exception The token is invalid and the user needs to reauthenticate
* @throws DomainException General error where it is safe to show a message to the user
* @throws RuntimeException Unexpected error from service
*/
public function userProfileName( \IPS\Member $member )
public function userProfileName( Member $member ): ?string
{
if ( !( $link = $this->_link( $member ) ) )
{
throw new \IPS\Login\Exception( NULL, \IPS\Login\Exception::INTERNAL_ERROR );
throw new Exception( "", Exception::INTERNAL_ERROR );
}
return $this->authenticatedUserName( $link['token_access_token'], $link['token_secret'] );
@@ -455,17 +480,17 @@ abstract class _OAuth1 extends \IPS\Login\Handler
* Get user's email address
* May return NULL if server doesn't support this
*
* @param \IPS\Member $member Member
* @param Member $member Member
* @return string|NULL
* @throws \IPS\Login\Exception The token is invalid and the user needs to reauthenticate
* @throws \DomainException General error where it is safe to show a message to the user
* @throws \RuntimeException Unexpected error from service
* @throws Exception The token is invalid and the user needs to reauthenticate
* @throws DomainException General error where it is safe to show a message to the user
* @throws RuntimeException Unexpected error from service
*/
public function userEmail( \IPS\Member $member )
public function userEmail( Member $member ): ?string
{
if ( !( $link = $this->_link( $member ) ) )
{
throw new \IPS\Login\Exception( $error['message'], \IPS\Login\Exception::INTERNAL_ERROR );
throw new Exception( "", Exception::INTERNAL_ERROR );
}
return $this->authenticatedEmail( $link['token_access_token'], $link['token_secret'] );
@@ -476,10 +501,10 @@ abstract class _OAuth1 extends \IPS\Login\Handler
/**
* Show in Account Settings?
*
* @param \IPS\Member|NULL $member The member, or NULL for if it should show generally
* @param Member|NULL $member The member, or NULL for if it should show generally
* @return bool
*/
public function showInUcp( \IPS\Member $member = NULL )
public function showInUcp( Member $member = NULL ): bool
{
$return = parent::showInUcp( $member );
@@ -495,7 +520,7 @@ abstract class _OAuth1 extends \IPS\Login\Handler
*
* @return bool
*/
public function hasSyncOptions()
public function hasSyncOptions(): bool
{
return TRUE;
}