X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/173e92edb838ca423db1637cd767543a582f1c07..85d17f257c338f668a1d17d9fc62a2f48ec84230:/app/controllers/oauth_controller.rb diff --git a/app/controllers/oauth_controller.rb b/app/controllers/oauth_controller.rb index 8af8af5e7..d4d1bd888 100644 --- a/app/controllers/oauth_controller.rb +++ b/app/controllers/oauth_controller.rb @@ -1,63 +1,67 @@ +require 'oauth/controllers/provider_controller' + class OauthController < ApplicationController - layout 'site' + include OAuth::Controllers::ProviderController - before_filter :authorize_web, :only => [:oauthorize, :revoke] - before_filter :set_locale, :only => [:oauthorize, :revoke] - before_filter :require_user, :only => [:oauthorize] - before_filter :verify_oauth_consumer_signature, :only => [:request_token] - before_filter :verify_oauth_request_token, :only => [:access_token] - # Uncomment the following if you are using restful_open_id_authentication - # skip_before_filter :verify_authenticity_token + layout 'slim' - def request_token - @token = current_client_application.create_request_token + def login_required + authorize_web + set_locale + require_user + end - logger.info "in REQUEST TOKEN" - if @token - logger.info "request token params: #{params.inspect}" - # request tokens indicate what permissions the client *wants*, not - # necessarily the same as those which the user allows. - current_client_application.permissions.each do |pref| - logger.info "PARAMS found #{pref}" + def user_authorizes_token? + any_auth = false + + @token.client_application.permissions.each do |pref| + if params[pref] @token.write_attribute(pref, true) + any_auth ||= true + else + @token.write_attribute(pref, false) end - @token.save! - - render :text => @token.to_query - else - render :nothing => true, :status => 401 end + + any_auth end - def access_token - @token = current_token && current_token.exchange! + def revoke + @token = current_user.oauth_tokens.find_by_token params[:token] if @token - render :text => @token.to_query - else - render :nothing => true, :status => 401 + @token.invalidate! + flash[:notice] = t('oauth.revoke.flash', :application => @token.client_application.name) end + redirect_to :controller => 'oauth_clients', :action => 'index' end - def oauthorize - @token = RequestToken.find_by_token params[:oauth_token] +protected + + def oauth1_authorize + unless @token + render :action=>"authorize_failure" + return + end + unless @token.invalidated? if request.post? - any_auth = false - @token.client_application.permissions.each do |pref| - if params[pref] - logger.info "OAUTHORIZE PARAMS found #{pref}" - @token.write_attribute(pref, true) - any_auth ||= true + if user_authorizes_token? + @token.authorize!(current_user) + if @token.oauth10? + callback_url = params[:oauth_callback] || @token.client_application.callback_url else - @token.write_attribute(pref, false) + callback_url = @token.oob? ? @token.client_application.callback_url : @token.callback_url end - end + @redirect_url = URI.parse(callback_url) unless callback_url.blank? - if any_auth - @token.authorize!(@user) - redirect_url = params[:oauth_callback] || @token.client_application.callback_url - if redirect_url - redirect_to "#{redirect_url}?oauth_token=#{@token.token}" + unless @redirect_url.to_s.blank? + @redirect_url.query = @redirect_url.query.blank? ? + "oauth_token=#{@token.token}" : + @redirect_url.query + "&oauth_token=#{@token.token}" + unless @token.oauth10? + @redirect_url.query += "&oauth_verifier=#{@token.verifier}" + end + redirect_to @redirect_url.to_s else render :action => "authorize_success" end @@ -70,14 +74,4 @@ class OauthController < ApplicationController render :action => "authorize_failure" end end - - def revoke - @token = @user.oauth_tokens.find_by_token params[:token] - if @token - @token.invalidate! - flash[:notice] = t('oauth.revoke.flash', :application => @token.client_application.name) - end - logger.info "about to redirect" - redirect_to :controller => 'oauth_clients', :action => 'index' - end end