server.php

Joomla15 - 最新开源CMS

<?php
// Check to ensure this file is within the rest of the framework
defined('JPATH_BASE') or die();

/**
 * OpenID server protocol and logic.
 *
 * Overview
 *
 * An OpenID server must perform three tasks:
 *
 *  1. Examine the incoming request to determine its nature and validity.
 *  2. Make a decision about how to respond to this request.
 *  3. Format the response according to the protocol.
 *
 * The first and last of these tasks may performed by the
 * 'decodeRequest' and 'encodeResponse' methods of the
 * Auth_OpenID_Server object.  Who gets to do the intermediate task --
 * deciding how to respond to the request -- will depend on what type
 * of request it is.
 *
 * If it's a request to authenticate a user (a 'checkid_setup' or
 * 'checkid_immediate' request), you need to decide if you will assert
 * that this user may claim the identity in question.  Exactly how you
 * do that is a matter of application policy, but it generally
 * involves making sure the user has an account with your system and
 * is logged in, checking to see if that identity is hers to claim,
 * and verifying with the user that she does consent to releasing that
 * information to the party making the request.
 *
 * Examine the properties of the Auth_OpenID_CheckIDRequest object,
 * and if and when you've come to a decision, form a response by
 * calling Auth_OpenID_CheckIDRequest::answer.
 *
 * Other types of requests relate to establishing associations between
 * client and server and verifing the authenticity of previous
 * communications.  Auth_OpenID_Server contains all the logic and data
 * necessary to respond to such requests; just pass it to
 * Auth_OpenID_Server::handleRequest.
 *
 * OpenID Extensions
 *
 * Do you want to provide other information for your users in addition
 * to authentication?  Version 1.2 of the OpenID protocol allows
 * consumers to add extensions to their requests.  For example, with
 * sites using the Simple Registration
 * Extension
 * (http://www.openidenabled.com/openid/simple-registration-extension/),
 * a user can agree to have their nickname and e-mail address sent to
 * a site when they sign up.
 *
 * Since extensions do not change the way OpenID authentication works,
 * code to handle extension requests may be completely separate from
 * the Auth_OpenID_Request class here.  But you'll likely want data
 * sent back by your extension to be signed.  Auth_OpenID_Response
 * provides methods with which you can add data to it which can be
 * signed with the other data in the OpenID signature.
 *
 * For example:
 *
 *   //  when request is a checkid_* request
 *   response = request.answer(True)
 *   // this will a signed 'openid.sreg.timezone' parameter to the response
 *   response.addField('sreg', 'timezone', 'America/Los_Angeles')
 *
 * Stores
 *
 * The OpenID server needs to maintain state between requests in order
 * to function.  Its mechanism for doing this is called a store.  The
 * store interface is defined in Interface.php.  Additionally, several
 * concrete store implementations are provided, so that most sites
 * won't need to implement a custom store.  For a store backed by flat
 * files on disk, see Auth_OpenID_FileStore.  For stores based on
 * MySQL, SQLite, or PostgreSQL, see the Auth_OpenID_SQLStore
 * subclasses.
 *
 * Upgrading
 *
 * The keys by which a server looks up associations in its store have
 * changed in version 1.2 of this library.  If your store has entries
 * created from version 1.0 code, you should empty it.
 *
 * PHP versions 4 and 5
 *
 * LICENSE: See the COPYING file included in this distribution.
 *
 * @package OpenID
 * @author JanRain, Inc. <[e-mail]>
 * @copyright 2005 Janrain, Inc.
 * @license http://www.gnu.org/copyleft/lesser.html LGPL
 */

/**
 * Required imports
 */
require_once "Auth/OpenID.php";
require_once "Auth/OpenID/Association.php";
require_once "Auth/OpenID/CryptUtil.php";
require_once "Auth/OpenID/BigMath.php";
require_once "Auth/OpenID/DiffieHellman.php";
require_once "Auth/OpenID/KVForm.php";
require_once "Auth/OpenID/TrustRoot.php";
require_once "Auth/OpenID/ServerRequest.php";

define('AUTH_OPENID_HTTP_OK', 200);
define('AUTH_OPENID_HTTP_REDIRECT', 302);
define('AUTH_OPENID_HTTP_ERROR', 400);

global $_Auth_OpenID_Request_Modes,
    $_Auth_OpenID_OpenID_Prefix,
    $_Auth_OpenID_Encode_Kvform,
    $_Auth_OpenID_Encode_Url;

/**
 * @access private
 */
$_Auth_OpenID_Request_Modes = array('checkid_setup',
                                    'checkid_immediate');

/**
 * @access private
 */
$_Auth_OpenID_OpenID_Prefix = "openid.";

/**
 * @access private
 */
$_Auth_OpenID_Encode_Kvform = array('kfvorm');

/**
 * @access private
 */
$_Auth_OpenID_Encode_Url = array('URL/redirect');

/**
 * @access private
 */
function _isError($obj, $cls = 'Auth_OpenID_ServerError')
{
    return is_a($obj, $cls);
}

/**
 * An error class which gets instantiated and returned whenever an
 * OpenID protocol error occurs.  Be prepared to use this in place of
 * an ordinary server response.
 *
 * @package OpenID
 */
class Auth_OpenID_ServerError {
    /**
     * @access private
     */
    function Auth_OpenID_ServerError($query = null, $message = null)
    {
        $this->message = $message;
        $this->query = $query;
    }

    /**
     * Returns the return_to URL for the request which caused this
     * error.
     */
    function hasReturnTo()
    {
        global $_Auth_OpenID_OpenID_Prefix;
        if ($this->query) {
            return array_key_exists($_Auth_OpenID_OpenID_Prefix .
                                    'return_to', $this->query);
        } else {
            return false;
        }
    }

    /**
     * Encodes this error's response as a URL suitable for
     * redirection.  If the response has no return_to, another
     * Auth_OpenID_ServerError is returned.
     */
    function encodeToURL()
    {
        global $_Auth_OpenID_OpenID_Prefix;
        $return_to = Auth_OpenID::arrayGet($this->query,
                                           $_Auth_OpenID_OpenID_Prefix .
                                           'return_to');
        if (!$return_to) {
            return new Auth_OpenID_ServerError(null, "no return_to URL");
        }

        return Auth_OpenID::appendArgs($return_to,
                            array('openid.mode' => 'error',
                                  'openid.error' => $this->toString()));
    }

    /**
     * Encodes the response to key-value form.  This is a
     * machine-readable format used to respond to messages which came
     * directly from the consumer and not through the user-agent.  See
     * the OpenID specification.
     */
    function encodeToKVForm()
    {
        return Auth_OpenID_KVForm::fromArray(
                                      array('mode' => 'error',
                                            'error' => $this->toString()));
    }

    /**
     * Returns one of $_Auth_OpenID_Encode_Url,
     * $_Auth_OpenID_Encode_Kvform, or null, depending on the type of
     * encoding expected for this error's payload.
     */
    function whichEncoding()
    {
        global $_Auth_OpenID_Encode_Url,
            $_Auth_OpenID_Encode_Kvform,
            $_Auth_OpenID_Request_Modes;

        if ($this->hasReturnTo()) {
            return $_Auth_OpenID_Encode_Url;
        }

        $mode = Auth_OpenID::arrayGet($this->query, 'openid.mode');

        if ($mode) {
            if (!in_array($mode, $_Auth_OpenID_Request_Modes)) {
                return $_Auth_OpenID_Encode_Kvform;
            }
        }
        return null;
    }

    /**
     * Returns this error message.
     */
    function toString()
    {
        if ($this->message) {
            return $this->message;
        } else {
            return get_class($this) . " error";
        }
    }
}

/**
 * An error indicating that the return_to URL is malformed.
 *
 * @package OpenID
 */
class Auth_OpenID_MalformedReturnURL extends Auth_OpenID_ServerError {
    function Auth_OpenID_MalformedReturnURL($query, $return_to)
    {
        $this->return_to = $return_to;
        parent::Auth_OpenID_ServerError($query, "malformed return_to URL");
    }
}

/**
 * This error is returned when the trust_root value is malformed.
 *
 * @package OpenID
 */
class Auth_OpenID_MalformedTrustRoot extends Auth_OpenID_ServerError {
    function toString()
    {
        return "Malformed trust root";
    }
}

/**
 * The base class for all server request classes.
 *
 * @access private
 * @package OpenID
 */
class Auth_OpenID_Request {
    var $mode = null;
}

/**
 * A request to verify the validity of a previous response.
 *
 * @access private
 * @package OpenID
 */
class Auth_OpenID_CheckAuthRequest extends Auth_OpenID_Request {
    var $mode = "check_authentication";
    var $invalidate_handle = null;

    function Auth_OpenID_CheckAuthRequest($assoc_handle, $sig, $signed,
                                          $invalidate_handle = null)
    {
        $this->assoc_handle = $assoc_handle;
        $this->sig = $sig;
        $this->signed = $signed;
        if ($invalidate_handle !== null) {
            $this->invalidate_handle = $invalidate_handle;
        }
    }

    function fromQuery($query)
    {
        global $_Auth_OpenID_OpenID_Prefix;

        $required_keys = array('assoc_handle', 'sig', 'signed');

        foreach ($required_keys as $k) {
            if (!array_key_exists($_Auth_OpenID_OpenID_Prefix . $k,
                                  $query)) {
                return new Auth_OpenID_ServerError($query,
                    sprintf("%s request missing required parameter %s from \
                            query", "check_authentication", $k));
            }
        }

        $assoc_handle = $query[$_Auth_OpenID_OpenID_Prefix . 'assoc_handle'];
        $sig = $query[$_Auth_OpenID_OpenID_Prefix . 'sig'];
        $signed_list = $query[$_Auth_OpenID_OpenID_Prefix . 'signed'];

        $signed_list = explode(",", $signed_list);
        $signed_pairs = array();

        foreach ($signed_list as $field) {
            if ($field == 'mode') {
                // XXX KLUDGE HAX WEB PROTOCoL BR0KENNN
                //
                // openid.mode is currently check_authentication
                // because that's the mode of this request.  But the
                // signature was made on something with a different
                // openid.mode.
                $value = "id_res";
            } else {
                if (array_key_exists($_Auth_OpenID_OpenID_Prefix . $field,
                                     $query)) {
                    $value = $query[$_Auth_OpenID_OpenID_Prefix . $field];
                } else {
                    return new Auth_OpenID_ServerError($query,
                          sprintf("Couldn't find signed field %r in query %s",
                                  $field, var_export($query, true)));
                }
            }
            $signed_pairs[] = array($field, $value);
        }

        $result = new Auth_OpenID_CheckAuthRequest($assoc_handle, $sig,
                                                   $signed_pairs);
        $result->invalidate_handle = Auth_OpenID::arrayGet($query,
                    $_Auth_OpenID_OpenID_Prefix . 'invalidate_handle');
        return $result;
    }

    function answer(&$signatory)
    {
        $is_valid = $signatory->verify($this->assoc_handle, $this->sig,
                                       $this->signed);

        // Now invalidate that assoc_handle so it this checkAuth
        // message cannot be replayed.
        $signatory->invalidate($this->assoc_handle, true);
        $response = new Auth_OpenID_ServerResponse($this);
        $response->fields['is_valid'] = $is_valid ? "true" : "false";

        if ($this->invalidate_handle) {
            $assoc = $signatory->getAssociation($this->invalidate_handle,
                                                false);
            if (!$assoc) {
                $response->fields['invalidate_handle'] =
                    $this->invalidate_handle;
            }
        }
        return $response;
    }
}

class Auth_OpenID_PlainTextServerSession {
    /**
     * An object that knows how to handle association requests with no
     * session type.
     */
    var $session_type = 'plaintext';

    function fromQuery($unused_request)
    {
        return new Auth_OpenID_PlainTextServerSession();
    }

    function answer($secret)
    {
        return array('mac_key' => base64_encode($secret));
    }
}

class Auth_OpenID_DiffieHellmanServerSession {
    /**
     * An object that knows how to handle association requests with
     * the Diffie-Hellman session type.
     */

    var $session_type = 'DH-SHA1';

    function Auth_OpenID_DiffieHellmanServerSession($dh, $consumer_pubkey)
    {
        $this->dh = $dh;
        $this->consumer_pubkey = $consumer_pubkey;
    }

    function fromQuery($query)
    {
        $dh_modulus = Auth_OpenID::arrayGet($query, 'openid.dh_modulus');
        $dh_gen = Auth_OpenID::arrayGet($query, 'openid.dh_gen');

        if ((($dh_modulus === null) && ($dh_gen !== null)) ||
            (($dh_gen === null) && ($dh_modulus !== null))) {

            if ($dh_modulus === null) {
                $missing = 'modulus';
            } else {
                $missing = 'generator';
            }

            return new Auth_OpenID_ServerError(
                                'If non-default modulus or generator is '.
                                'supplied, both must be supplied.  Missing '.
                                $missing);
        }

        $lib =& Auth_OpenID_getMathLib();

        if ($dh_modulus || $dh_gen) {
            $dh_modulus = $lib->base64ToLong($dh_modulus);
            $dh_gen = $lib->base64ToLong($dh_gen);
            if ($lib->cmp($dh_modulus, 0) == 0 ||
                $lib->cmp($dh_gen, 0) == 0) {
                return new Auth_OpenID_ServerError(
                  $query, "Failed to parse dh_mod or dh_gen");
            }