Compare commits
No commits in common. "develop" and "master" have entirely different histories.
36
index.php
36
index.php
|
@ -1,5 +1,5 @@
|
|||
<?php
|
||||
/* Multi-user IndieAuth endpoint using server envvars from SSO
|
||||
/* Single user IndieAuth endpoint using server envvars from SSO
|
||||
* Based on https://github.com/inklings-io/selfauth
|
||||
*/
|
||||
require_once 'functions.php';
|
||||
|
@ -16,31 +16,21 @@ if ( ! is_null($code) ){
|
|||
if ( ! (
|
||||
is_string($code) &&
|
||||
is_string($redirect_uri) &&
|
||||
is_string($client_id)
|
||||
is_string($client_id) &&
|
||||
verify_signed_code( APP_KEY, USER_URL . $redirect_uri . $client_id, $code )
|
||||
) ) {
|
||||
$error = 'Invalid request';
|
||||
http_response_code(400);
|
||||
include 'form.php';
|
||||
die();
|
||||
}
|
||||
|
||||
$code_parts = explode(':', $code, 3);
|
||||
$suffix_parts = explode(':', base64_url_decode( $code_parts[2] ), 2 );
|
||||
$user = $suffix_parts[0];
|
||||
|
||||
if ( ! verify_signed_code( APP_KEY, $user . $redirect_uri . $client_id, $code ) ) {
|
||||
$error = 'Invalid code';
|
||||
http_response_code(400);
|
||||
include 'form.php';
|
||||
die();
|
||||
}
|
||||
|
||||
$response = array('me' => USER_URLS[$user]);
|
||||
|
||||
$response = array('me' => USER_URL);
|
||||
$code_parts = explode(':', $code, 3);
|
||||
$accept_header = $_SERVER['HTTP_ACCEPT'] ?: '*/*';
|
||||
|
||||
if ( '' !== $suffix_parts[1] ) {
|
||||
$response['scope'] = $suffix_parts[1];
|
||||
if ( '' !== $code_parts[2] ) {
|
||||
$response['scope'] = base64_url_decode($code_parts[2]);
|
||||
}
|
||||
|
||||
$json = get_q_value('application/json', $accept_header);
|
||||
|
@ -62,14 +52,13 @@ if ( ! is_null($code) ){
|
|||
|
||||
// No code submitted,
|
||||
// Check login
|
||||
$user = $_SERVER["REMOTE_USER"];
|
||||
if ( is_null($user) ) {
|
||||
if ( is_null($_SERVER["REMOTE_USER"]) ) {
|
||||
$error = 'Not logged in. Login on the <a href="https://auth.cool110.xyz/">SSO portal</a>';
|
||||
http_response_code(403);
|
||||
include 'form.php';
|
||||
die();
|
||||
} elseif ( ! array_key_exists( $user, USER_URLS ) ){
|
||||
$error = 'Account not provisioned';
|
||||
} elseif ( USER_NAME !== $_SERVER["REMOTE_USER"] ){
|
||||
$error = 'This system is for ' . USER_NAME . ' only.';
|
||||
http_response_code(403);
|
||||
include 'form.php';
|
||||
die();
|
||||
|
@ -119,8 +108,7 @@ if ( ! is_null($csrf_code) ) {
|
|||
$scope = implode( ' ', $scope );
|
||||
}
|
||||
|
||||
$suffix = $user . ':' . $scope;
|
||||
$code = create_signed_code( APP_KEY, $user . $redirect_uri . $client_id, 5 * 60, $suffix );
|
||||
$code = create_signed_code( APP_KEY, USER_URL . $redirect_uri . $client_id, 5 * 60, $scope );
|
||||
|
||||
$final_redir = $redirect_uri;
|
||||
if ( strpos($redirect_uri, '?') === false ) {
|
||||
|
@ -131,7 +119,7 @@ if ( ! is_null($csrf_code) ) {
|
|||
|
||||
$parameters = array(
|
||||
'code' => $code,
|
||||
'me' => USER_URLS[$user]
|
||||
'me' => USER_URL
|
||||
);
|
||||
if ( ! is_null($state) ) {
|
||||
$parameters['state'] = $state;
|
||||
|
|
Loading…
Reference in a new issue