<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\auth\provider\oauth;
use OAuth\Common\Http\Exception\TokenResponseException;
use OAuth\ServiceFactory;
use OAuth\Common\Consumer\Credentials;
use OAuth\Common\Service\ServiceInterface;
use OAuth\OAuth1\Service\AbstractService as OAuth1Service;
use OAuth\OAuth2\Service\AbstractService as OAuth2Service;
use phpbb\auth\provider\base;
use phpbb\auth\provider\db;
use phpbb\auth\provider\oauth\service\exception;
use phpbb\config\config;
use phpbb\db\driver\driver_interface;
use phpbb\di\service_collection;
use phpbb\event\dispatcher;
use phpbb\language\language;
use phpbb\request\request_interface;
use phpbb\user;
/**
* OAuth authentication provider for phpBB3
*/
class oauth extends base
{
/** @var config */
protected $config;
/** @var driver_interface */
protected $db;
/** @var db */
protected $db_auth;
/** @var dispatcher */
protected $dispatcher;
/** @var language */
protected $language;
/** @var request_interface */
protected $request;
/** @var service_collection */
protected $service_providers;
/** @var user */
protected $user;
/** @var string OAuth table: token storage */
protected $oauth_token_table;
/** @var string OAuth table: state */
protected $oauth_state_table;
/** @var string OAuth table: account association */
protected $oauth_account_table;
/** @var string Users table */
protected $users_table;
/** @var string phpBB root path */
protected $root_path;
/** @var string php File extension */
protected $php_ext;
/**
* Constructor.
*
* @param config $config Config object
* @param driver_interface $db Database object
* @param db $db_auth DB auth provider
* @param dispatcher $dispatcher Event dispatcher object
* @param language $language Language object
* @param request_interface $request Request object
* @param service_collection $service_providers OAuth providers service collection
* @param user $user User object
* @param string $oauth_token_table OAuth table: token storage
* @param string $oauth_state_table OAuth table: state
* @param string $oauth_account_table OAuth table: account association
* @param string $users_table User table
* @param string $root_path phpBB root path
* @param string $php_ext php File extension
*/
public function __construct(
config $config,
driver_interface $db,
db $db_auth,
dispatcher $dispatcher,
language $language,
request_interface $request,
service_collection $service_providers,
user $user,
$oauth_token_table,
$oauth_state_table,
$oauth_account_table,
$users_table,
$root_path,
$php_ext
)
{
$this->config = $config;
$this->db = $db;
$this->db_auth = $db_auth;
$this->dispatcher = $dispatcher;
$this->language = $language;
$this->service_providers = $service_providers;
$this->request = $request;
$this->user = $user;
$this->oauth_token_table = $oauth_token_table;
$this->oauth_state_table = $oauth_state_table;
$this->oauth_account_table = $oauth_account_table;
$this->users_table = $users_table;
$this->root_path = $root_path;
$this->php_ext = $php_ext;
}
/**
* {@inheritdoc}
*/
public function init()
{
// This does not test whether or not the key and secret provided are valid.
foreach ($this->service_providers as $service_provider)
{
$credentials = $service_provider->get_service_credentials();
if (($credentials['key'] && !$credentials['secret']) || (!$credentials['key'] && $credentials['secret']))
{
return $this->language->lang('AUTH_PROVIDER_OAUTH_ERROR_ELEMENT_MISSING');
}
}
return false;
}
/**
* {@inheritdoc}
*/
public function login($username, $password)
{
// Temporary workaround for only having one authentication provider available
if (!$this->request->is_set('oauth_service'))
{
return $this->db_auth->login($username, $password);
}
// Request the name of the OAuth service
$provider = $this->request->variable('oauth_service', '', false);
$service_name = $this->get_service_name($provider);
if ($provider === '' || !array_key_exists($service_name, $this->service_providers))
{
return [
'status' => LOGIN_ERROR_EXTERNAL_AUTH,
'error_msg' => 'LOGIN_ERROR_OAUTH_SERVICE_DOES_NOT_EXIST',
'user_row' => ['user_id' => ANONYMOUS],
];
}
// Get the service credentials for the given service
$storage = new token_storage($this->db, $this->user, $this->oauth_token_table, $this->oauth_state_table);
$query = 'mode=login&login=external&oauth_service=' . $provider;
try
{
/** @var OAuth1Service|OAuth2Service $service */
$service = $this->get_service($provider, $storage, $query);
}
catch (\Exception $e)
{
return [
'status' => LOGIN_ERROR_EXTERNAL_AUTH,
'error_msg' => $e->getMessage(),
'user_row' => ['user_id' => ANONYMOUS],
];
}
if ($this->is_set_code($service))
{
$this->service_providers[$service_name]->set_external_service_provider($service);
try
{
$unique_id = $this->service_providers[$service_name]->perform_auth_login();
}
catch (exception $e)
{
return [
'status' => LOGIN_ERROR_EXTERNAL_AUTH,
'error_msg' => $e->getMessage(),
'user_row' => ['user_id' => ANONYMOUS],
];
}
/**
* Check to see if this provider is already associated with an account.
*
* Enforcing a data type to make sure it are strings and not integers,
* so values are quoted in the SQL WHERE statement.
*/
$data = [
'provider' => (string) utf8_strtolower($provider),
'oauth_provider_id' => (string) $unique_id
];
$sql = 'SELECT user_id
FROM ' . $this->oauth_account_table . '
WHERE ' . $this->db->sql_build_array('SELECT', $data);
$result = $this->db->sql_query($sql);
$row = $this->db->sql_fetchrow($result);
$this->db->sql_freeresult($result);
$redirect_data = array(
'auth_provider' => 'oauth',
'login_link_oauth_service' => $provider,
);
/**
* Event is triggered before check if provider is already associated with an account
*
* @event core.oauth_login_after_check_if_provider_id_has_match
* @var array row User row
* @var array data Provider data
* @var array redirect_data Data to be appended to the redirect url
* @var ServiceInterface service OAuth service
* @since 3.2.3-RC1
* @changed 3.2.6-RC1 Added redirect_data
*/
$vars = [
'row',
'data',
'redirect_data',
'service',
];
extract($this->dispatcher->trigger_event('core.oauth_login_after_check_if_provider_id_has_match', compact($vars)));
if (!$row)
{
// The user does not yet exist, ask to link or create profile
return [
'status' => LOGIN_SUCCESS_LINK_PROFILE,
'error_msg' => 'LOGIN_OAUTH_ACCOUNT_NOT_LINKED',
'user_row' => [],
'redirect_data' => $redirect_data,
];
}
// Retrieve the user's account
$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_ip, user_type, user_login_attempts
FROM ' . $this->users_table . '
WHERE user_id = ' . (int) $row['user_id'];
$result = $this->db->sql_query($sql);
$row = $this->db->sql_fetchrow($result);
$this->db->sql_freeresult($result);
if (!$row)
{
return [
'status' => LOGIN_ERROR_EXTERNAL_AUTH,
'error_msg' => 'AUTH_PROVIDER_OAUTH_ERROR_INVALID_ENTRY',
'user_row' => ['user_id' => ANONYMOUS],
];
}
/**
* Check if the user is banned.
* The fourth parameter (return) has to be true, otherwise the OAuth login is still called and
* an uncaught exception is thrown as there is no token stored in the database.
*/
$ban = $this->user->check_ban($row['user_id'], $row['user_ip'], $row['user_email'], true);
if (!empty($ban))
{
$till_date = !empty($ban['ban_end']) ? $this->user->format_date($ban['ban_end']) : '';
$message = !empty($ban['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
$contact_link = phpbb_get_board_contact_link($this->config, $this->root_path, $this->php_ext);
$message = $this->language->lang($message, $till_date, '<a href="' . $contact_link . '">', '</a>');
$message .= !empty($ban['ban_give_reason']) ? '<br /><br />' . $this->language->lang('BOARD_BAN_REASON', $ban['ban_give_reason']) : '';
$message .= !empty($ban['ban_triggered_by']) ? '<br /><br /><em>' . $this->language->lang('BAN_TRIGGERED_BY_' . utf8_strtoupper($ban['ban_triggered_by'])) . '</em>' : '';
return [
'status' => LOGIN_BREAK,
'error_msg' => $message,
'user_row' => $row,
];
}
// Update token storage to store the user_id
$storage->set_user_id($row['user_id']);
/**
* Event is triggered after user is successfully logged in via OAuth.
*
* @event core.auth_oauth_login_after
* @var array row User row
* @since 3.1.11-RC1
*/
$vars = [
'row',
];
extract($this->dispatcher->trigger_event('core.auth_oauth_login_after', compact($vars)));
// The user is now authenticated and can be logged in
return [
'status' => LOGIN_SUCCESS,
'error_msg' => false,
'user_row' => $row,
];
}
else
{
return $this->set_redirect($service);
}
}
/**
* {@inheritdoc}
*/
public function get_login_data()
{
$login_data = [
'TEMPLATE_FILE' => 'login_body_oauth.html',
'BLOCK_VAR_NAME' => 'oauth',
'BLOCK_VARS' => [],
];
foreach ($this->service_providers as $service_name => $service_provider)
{
// Only include data if the credentials are set
$credentials = $service_provider->get_service_credentials();
if ($credentials['key'] && $credentials['secret'])
{
$provider = $this->get_provider($service_name);
$redirect_url = generate_board_url() . '/ucp.' . $this->php_ext . '?mode=login&login=external&oauth_service=' . $provider;
$login_data['BLOCK_VARS'][$service_name] = [
'REDIRECT_URL' => redirect($redirect_url, true),
'SERVICE_NAME' => $this->get_provider_title($provider),
];
}
}
return $login_data;
}
/**
* {@inheritdoc}
*/
public function acp()
{
$ret = [];
foreach ($this->service_providers as $service_name => $service_provider)
{
$provider = $this->get_provider($service_name);
$provider = utf8_strtolower($provider);
$ret[] = 'auth_oauth_' . $provider . '_key';
$ret[] = 'auth_oauth_' . $provider . '_secret';
}
return $ret;
}
/**
* {@inheritdoc}
*/
public function get_acp_template($new_config)
{
$ret = [
'BLOCK_VAR_NAME' => 'oauth_services',
'BLOCK_VARS' => [],
'TEMPLATE_FILE' => 'auth_provider_oauth.html',
'TEMPLATE_VARS' => [],
];
foreach ($this->service_providers as $service_name => $service_provider)
{
$provider = $this->get_provider($service_name);
$ret['BLOCK_VARS'][$provider] = [
'NAME' => $provider,
'ACTUAL_NAME' => $this->get_provider_title($provider),
'KEY' => $new_config['auth_oauth_' . utf8_strtolower($provider) . '_key'],
'SECRET' => $new_config['auth_oauth_' . utf8_strtolower($provider) . '_secret'],
];
}
return $ret;
}
/**
* {@inheritdoc}
*/
public function login_link_has_necessary_data($login_link_data)
{
if (empty($login_link_data))
{
return 'LOGIN_LINK_NO_DATA_PROVIDED';
}
if (!array_key_exists('oauth_service', $login_link_data) || !$login_link_data['oauth_service'] ||
!array_key_exists('link_method', $login_link_data) || !$login_link_data['link_method'])
{
return 'LOGIN_LINK_MISSING_DATA';
}
return null;
}
/**
* {@inheritdoc}
*/
public function link_account(array $link_data)
{
// Check for a valid link method (auth_link or login_link)
if (!array_key_exists('link_method', $link_data) ||
!in_array($link_data['link_method'], ['auth_link', 'login_link']))
{
return 'LOGIN_LINK_MISSING_DATA';
}
// We must have an oauth_service listed, check for it two ways
if (!array_key_exists('oauth_service', $link_data) || !$link_data['oauth_service'])
{
$link_data['oauth_service'] = $this->request->variable('oauth_service', '');
if (!$link_data['oauth_service'])
{
return 'LOGIN_LINK_MISSING_DATA';
}
}
$service_name = $this->get_service_name($link_data['oauth_service']);
if (!array_key_exists($service_name, $this->service_providers))
{
return 'LOGIN_ERROR_OAUTH_SERVICE_DOES_NOT_EXIST';
}
switch ($link_data['link_method'])
{
case 'auth_link':
return $this->link_account_auth_link($link_data, $service_name);
case 'login_link':
return $this->link_account_login_link($link_data, $service_name);
default:
return 'LOGIN_LINK_MISSING_DATA';
}
}
/**
* {@inheritdoc}
*/
public function logout($data, $new_session)
{
// Clear all tokens belonging to the user
$storage = new token_storage($this->db, $this->user, $this->oauth_token_table, $this->oauth_state_table);
$storage->clearAllTokens();
return;
}
/**
* {@inheritdoc}
*/
public function get_auth_link_data($user_id = 0)
{
$user_ids = [];
$block_vars = [];
$sql = 'SELECT oauth_provider_id, provider
FROM ' . $this->oauth_account_table . '
WHERE user_id = ' . ($user_id > 0 ? (int) $user_id : (int) $this->user->data['user_id']);
$result = $this->db->sql_query($sql);
while ($row = $this->db->sql_fetchrow($result))
{
$user_ids[$row['provider']] = $row['oauth_provider_id'];
}
$this->db->sql_freeresult($result);
foreach ($this->service_providers as $service_name => $service_provider)
{
// Only include data if the credentials are set
$credentials = $service_provider->get_service_credentials();
if ($credentials['key'] && $credentials['secret'])
{
$provider = $this->get_provider($service_name);
$block_vars[$service_name] = [
'SERVICE_NAME' => $this->get_provider_title($provider),
'UNIQUE_ID' => isset($user_ids[$provider]) ? $user_ids[$provider] : null,
'HIDDEN_FIELDS' => [
'link' => !isset($user_ids[$provider]),
'oauth_service' => $provider,
],
];
}
}
return [
'BLOCK_VAR_NAME' => 'oauth',
'BLOCK_VARS' => $block_vars,
'TEMPLATE_FILE' => 'ucp_auth_link_oauth.html',
];
}
/**
* {@inheritdoc}
*/
public function unlink_account(array $link_data)
{
if (!array_key_exists('oauth_service', $link_data) || !$link_data['oauth_service'])
{
return 'LOGIN_LINK_MISSING_DATA';
}
// Remove user specified in $link_data if possible
$user_id = isset($link_data['user_id']) ? $link_data['user_id'] : $this->user->data['user_id'];
// Remove the link
$sql = 'DELETE FROM ' . $this->oauth_account_table . "
WHERE provider = '" . $this->db->sql_escape($link_data['oauth_service']) . "'
AND user_id = " . (int) $user_id;
$this->db->sql_query($sql);
$service_name = $this->get_service_name($link_data['oauth_service']);
// Clear all tokens belonging to the user on this service
$storage = new token_storage($this->db, $this->user, $this->oauth_token_table, $this->oauth_state_table);
$storage->clearToken($service_name);
return false;
}
/**
* Performs the account linking for login_link.
*
* @param array $link_data The same variable given to
* {@see \phpbb\auth\provider\provider_interface::link_account}
* @param string $service_name The name of the service being used in linking.
* @return string|false Returns a language key (string) if an error is encountered,
* or false on success.
*/
protected function link_account_login_link(array $link_data, $service_name)
{
$storage = new token_storage($this->db, $this->user, $this->oauth_token_table, $this->oauth_state_table);
// Check for an access token, they should have one
if (!$storage->has_access_token_by_session($service_name))
{
return 'LOGIN_LINK_ERROR_OAUTH_NO_ACCESS_TOKEN';
}
// Prepare for an authentication request
$query = 'mode=login_link&login_link_oauth_service=' . $link_data['oauth_service'];
try
{
$service = $this->get_service($link_data['oauth_service'], $storage, $query);
}
catch (\Exception $e)
{
return $e->getMessage();
}
$this->service_providers[$service_name]->set_external_service_provider($service);
try
{
// The user has already authenticated successfully, request to authenticate again
$unique_id = $this->service_providers[$service_name]->perform_token_auth();
}
catch (exception $e)
{
return $e->getMessage();
}
// Insert into table, they will be able to log in after this
$data = [
'user_id' => $link_data['user_id'],
'provider' => utf8_strtolower($link_data['oauth_service']),
'oauth_provider_id' => $unique_id,
];
$this->link_account_perform_link($data);
// Update token storage to store the user_id
$storage->set_user_id($link_data['user_id']);
return false;
}
/**
* Performs the account linking for auth_link.
*
* @param array $link_data The same variable given to
* {@see \phpbb\auth\provider\provider_interface::link_account}
* @param string $service_name The name of the service being used in linking.
* @return string|false Returns a language constant (string) if an error is encountered,
* or false on success.
*/
protected function link_account_auth_link(array $link_data, $service_name)
{
$storage = new token_storage($this->db, $this->user, $this->oauth_token_table, $this->oauth_state_table);
$query = 'i=ucp_auth_link&mode=auth_link&link=1&oauth_service=' . $link_data['oauth_service'];
try
{
/** @var OAuth1Service|OAuth2Service $service */
$service = $this->get_service($link_data['oauth_service'], $storage, $query);
}
catch (\Exception $e)
{
return $e->getMessage();
}
if ($this->is_set_code($service))
{
$this->service_providers[$service_name]->set_external_service_provider($service);
try
{
$unique_id = $this->service_providers[$service_name]->perform_auth_login();
}
catch (exception $e)
{
return $e->getMessage();
}
// Insert into table, they will be able to log in after this
$data = [
'user_id' => $this->user->data['user_id'],
'provider' => utf8_strtolower($link_data['oauth_service']),
'oauth_provider_id' => $unique_id,
];
$this->link_account_perform_link($data);
return false;
}
else
{
return $this->set_redirect($service);
}
}
/**
* Performs the query that inserts an account link
*
* @param array $data This array is passed to db->sql_build_array
*/
protected function link_account_perform_link(array $data)
{
// Check if the external account is already associated with other user
$sql = 'SELECT user_id
FROM ' . $this->oauth_account_table . "
WHERE provider = '" . $this->db->sql_escape($data['provider']) . "'
AND oauth_provider_id = '" . $this->db->sql_escape($data['oauth_provider_id']) . "'";
$result = $this->db->sql_query($sql);
$row = $this->db->sql_fetchrow($result);
$this->db->sql_freeresult($result);
if ($row)
{
trigger_error('AUTH_PROVIDER_OAUTH_ERROR_ALREADY_LINKED');
}
// Link account
$sql = 'INSERT INTO ' . $this->oauth_account_table . ' ' . $this->db->sql_build_array('INSERT', $data);
$this->db->sql_query($sql);
/**
* Event is triggered after user links account.
*
* @event core.auth_oauth_link_after
* @var array data User row
* @since 3.1.11-RC1
*/
$vars = [
'data',
];
extract($this->dispatcher->trigger_event('core.auth_oauth_link_after', compact($vars)));
}
/**
* Returns a new service object.
*
* @param string $provider The name of the provider
* @param token_storage $storage Token storage object
* @param string $query The query string used for the redirect uri
* @return ServiceInterface
* @throws exception When OAuth service was not created
*/
protected function get_service($provider, token_storage $storage, $query)
{
$service_name = $this->get_service_name($provider);
/** @see \phpbb\auth\provider\oauth\service\service_interface::get_service_credentials */
$service_credentials = $this->service_providers[$service_name]->get_service_credentials();
/** @see \phpbb\auth\provider\oauth\service\service_interface::get_auth_scope */
$scopes = $this->service_providers[$service_name]->get_auth_scope();
$callback = generate_board_url() . "/ucp.{$this->php_ext}?{$query}";
// Setup the credentials for the requests
$credentials = new Credentials(
$service_credentials['key'],
$service_credentials['secret'],
$callback
);
$service_factory = new ServiceFactory;
// Allow providers to register a custom class or override the provider name
if ($class = $this->service_providers[$service_name]->get_external_service_class())
{
if (class_exists($class))
{
try
{
$service_factory->registerService($provider, $class);
}
catch (\OAuth\Common\Exception\Exception $e)
{
throw new exception('AUTH_PROVIDER_OAUTH_ERROR_INVALID_SERVICE_TYPE');
}
}
else
{
$provider = $class;
}
}
$service = $service_factory->createService($provider, $credentials, $storage, $scopes);
if (!$service)
{
throw new exception('AUTH_PROVIDER_OAUTH_ERROR_SERVICE_NOT_CREATED');
}
return $service;
}
/**
* Returns the service name for an OAuth provider name.
*
* @param string $provider The OAuth provider name
* @return string The service name
*/
protected function get_service_name($provider)
{
if (strpos($provider, 'auth.provider.oauth.service.') !== 0)
{
$provider = 'auth.provider.oauth.service.' . utf8_strtolower($provider);
}
return $provider;
}
/**
* Returns the OAuth provider name from a service name.
*
* @param string $service_name The service name
* @return string The OAuth provider name
*/
protected function get_provider($service_name)
{
return str_replace('auth.provider.oauth.service.', '', $service_name);
}
/**
* Returns the localized title for the OAuth provider.
*
* @param string $provider The OAuth provider name
* @return string The OAuth provider title
*/
protected function get_provider_title($provider)
{
return $this->language->lang('AUTH_PROVIDER_OAUTH_SERVICE_' . utf8_strtoupper($provider));
}
/**
* Returns whether or not the authorization code is set.
*
* @param OAuth1Service|OAuth2Service $service The external OAuth service
* @return bool Whether or not the authorization code is set in the URL
* for the respective OAuth service's version
*/
protected function is_set_code($service)
{
switch ($service::OAUTH_VERSION)
{
case 1:
return $this->request->is_set('oauth_token', request_interface::GET);
case 2:
return $this->request->is_set('code', request_interface::GET);
default:
return false;
}
}
/**
* Sets a redirect to the authorization uri.
*
* @param OAuth1Service|OAuth2Service $service The external OAuth service
* @return array|false Array if an error occurred,
* false on success
*/
protected function set_redirect($service)
{
$parameters = [];
if ($service::OAUTH_VERSION === 1)
{
try
{
$token = $service->requestRequestToken();
$parameters = ['oauth_token' => $token->getRequestToken()];
}
catch (TokenResponseException $e)
{
return [
'status' => LOGIN_ERROR_EXTERNAL_AUTH,
'error_msg' => $e->getMessage(),
'user_row' => ['user_id' => ANONYMOUS],
];
}
}
redirect($service->getAuthorizationUri($parameters), false, true);
return false;
}
}