X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/9fec2fd137619eed257f146542ae44d792cc49dd..bf9dd8f350ca1b54afb79dda79506d980ccb5738:/app/controllers/oauth_controller.rb?ds=sidebyside diff --git a/app/controllers/oauth_controller.rb b/app/controllers/oauth_controller.rb index c8ae12277..babd27c53 100644 --- a/app/controllers/oauth_controller.rb +++ b/app/controllers/oauth_controller.rb @@ -1,83 +1,78 @@ class OauthController < ApplicationController - layout 'site' + include OAuth::Controllers::ProviderController - before_filter :authorize_web, :only => [:oauthorize, :revoke] - before_filter :set_locale, :only => [:oauthorize, :revoke] - before_filter :require_user, :only => [:oauthorize] - before_filter :verify_oauth_consumer_signature, :only => [:request_token] - before_filter :verify_oauth_request_token, :only => [:access_token] - # Uncomment the following if you are using restful_open_id_authentication - # skip_before_filter :verify_authenticity_token + # The ProviderController will call login_required for any action that needs + # a login, but we want to check authorization on every action. + authorize_resource :class => false - def request_token - @token = current_client_application.create_request_token + layout "site" - logger.info "in REQUEST TOKEN" + def revoke + @token = current_user.oauth_tokens.find_by :token => params[:token] if @token - logger.info "request token params: #{params.inspect}" - # request tokens indicate what permissions the client *wants*, not - # necessarily the same as those which the user allows. - current_client_application.permissions.each do |pref| - logger.info "PARAMS found #{pref}" - @token.write_attribute(pref, true) - end - @token.save! - - render :text => @token.to_query - else - render :nothing => true, :status => 401 + @token.invalidate! + flash[:notice] = t(".flash", :application => @token.client_application.name) end + redirect_to oauth_clients_url(:display_name => @token.user.display_name) end - def access_token - @token = current_token && current_token.exchange! - if @token - render :text => @token.to_query - else - render :nothing => true, :status => 401 - end + protected + + def login_required + authorize_web + set_locale end - def oauthorize - @token = RequestToken.find_by_token params[:oauth_token] - unless @token.invalidated? - if request.post? - any_auth = false - @token.client_application.permissions.each do |pref| - if params[pref] - logger.info "OAUTHORIZE PARAMS found #{pref}" - @token.write_attribute(pref, true) - any_auth ||= true - else - @token.write_attribute(pref, false) - end - end + def user_authorizes_token? + any_auth = false - if any_auth - @token.authorize!(@user) - redirect_url = params[:oauth_callback] || @token.client_application.callback_url - if redirect_url - redirect_to "#{redirect_url}?oauth_token=#{@token.token}" - else - render :action => "authorize_success" - end - else - @token.invalidate! - render :action => "authorize_failure" - end + @token.client_application.permissions.each do |pref| + if params[pref] + @token.write_attribute(pref, true) + any_auth ||= true + else + @token.write_attribute(pref, false) end - else - render :action => "authorize_failure" end + + any_auth end - def revoke - @token = @user.oauth_tokens.find_by_token params[:token] - if @token - @token.invalidate! - flash[:notice] = "You've revoked the token for #{@token.client_application.name}" + def oauth1_authorize + override_content_security_policy_directives(:form_action => []) if Settings.csp_enforce || Settings.key?(:csp_report_url) + + if @token.invalidated? + @message = t "oauth.authorize_failure.invalid" + render :action => "authorize_failure" + elsif request.post? + if user_authorizes_token? + @token.authorize!(current_user) + callback_url = if @token.oauth10? + params[:oauth_callback] || @token.client_application.callback_url + else + @token.oob? ? @token.client_application.callback_url : @token.callback_url + end + @redirect_url = URI.parse(callback_url) if callback_url.present? + + if @redirect_url.to_s.blank? + render :action => "authorize_success" + else + @redirect_url.query = if @redirect_url.query.blank? + "oauth_token=#{@token.token}" + else + @redirect_url.query + + "&oauth_token=#{@token.token}" + end + + @redirect_url.query += "&oauth_verifier=#{@token.verifier}" unless @token.oauth10? + + redirect_to @redirect_url.to_s + end + else + @token.invalidate! + @message = t("oauth.authorize_failure.denied", :app_name => @token.client_application.name) + render :action => "authorize_failure" + end end - logger.info "about to redirect" - redirect_to :controller => 'oauth_clients', :action => 'index' end end