more work on magic-auth

2 files changed, 17 insertions, 4 deletions

diff --git a/mod/magic.php b/mod/magic.php
index 29d16eec5..a268f1ecb 100644
--- a/mod/magic.php
+++ b/mod/magic.php
@@ -20,7 +20,7 @@ function magic_init(&$a) {
 
 	$basepath = $parsed['scheme'] . '://' . $parsed['host'] . (($parsed['port']) ? ':' . $parsed['port'] : ''); 
 
-	$x = q("select * from hubloc where hubloc_url = '%s' order by hubloc_connected desc limit 1"
+	$x = q("select * from hubloc where hubloc_url = '%s' order by hubloc_connected desc limit 1",
 		dbesc($basepath)
 	);
 	
@@ -37,7 +37,7 @@ function magic_init(&$a) {
 
 				// Now try again
 
-				$x = q("select * from hubloc where hubloc_url = '%s' order by hubloc_connected desc limit 1"
+				$x = q("select * from hubloc where hubloc_url = '%s' order by hubloc_connected desc limit 1",
 					dbesc($basepath)
 				);
 			}
diff --git a/mod/post.php b/mod/post.php
index a0628bbfa..a7143aaf1 100644
--- a/mod/post.php
+++ b/mod/post.php
@@ -28,7 +28,7 @@ function post_init(&$a) {
  *
  ** auth => the urlencoded webbie (channel@host.domain) of the channel requesting access
  ** dest => the desired destination URL (urlencoded)
- ** sec  => a random string which is also stored on the remote site for use during the verification phase. 
+ ** sec  => a random string which is also stored on $mysite for use during the verification phase. 
  ** version => the zot revision
  *
  * When this packet is received, an "auth-check" zot message is sent to $mysite.
@@ -36,7 +36,7 @@ function post_init(&$a) {
  * If no information has been recorded about the requesting identity a zot information packet will be retrieved before
  * continuing.
  * 
- * The sender of this packet is a random site user. The recipients will be a single recipient corresponding
+ * The sender of this packet is a random site channel. The recipients will be a single recipient corresponding
  * to the guid and guid_sig we have associated with the requesting auth identity
  *
  *
@@ -578,6 +578,19 @@ function post_post(&$a) {
 
 	if($msgtype === 'auth_check') {
 
+		/**
+		 * Requestor visits /magic/?dest=somewhere on their own site with a browser
+		 * magic redirects them to $destsite/post [with auth args....]
+		 * $destsite sends an auth_check packet to originator site
+		 * The auth_check packet is handled here by the originator's site 
+		 * - the browser session is still waiting
+		 * inside $destsite/post for everything to verify
+		 * If everything checks out we'll return a token to $destsite
+		 * and then $destsite will verify the token, authenticate the browser
+		 * session and then redirect to the original destination.
+		 * If authentication fails, the redirection to the original destination
+		 * will still take place but without authentication.
+		 */
 		logger('mod_zot: auth_check', LOGGER_DEBUG);
 
 		if(! $encrypted_packet) {