aboutsummaryrefslogtreecommitdiffstats
path: root/mod
diff options
context:
space:
mode:
Diffstat (limited to 'mod')
-rw-r--r--mod/magic.php119
-rw-r--r--mod/post.php151
2 files changed, 208 insertions, 62 deletions
diff --git a/mod/magic.php b/mod/magic.php
index 2ea686b1b..c5aeb4c8e 100644
--- a/mod/magic.php
+++ b/mod/magic.php
@@ -4,58 +4,74 @@
function magic_init(&$a) {
- $url = ((x($_REQUEST,'url')) ? $_REQUEST['url'] : '');
$addr = ((x($_REQUEST,'addr')) ? $_REQUEST['addr'] : '');
$hash = ((x($_REQUEST,'hash')) ? $_REQUEST['hash'] : '');
$dest = ((x($_REQUEST,'dest')) ? $_REQUEST['dest'] : '');
+ if($hash) {
+ $x = q("select xchan.xchan_url, hubloc.* from xchan left join hubloc on xchan_hash = hubloc_hash
+ where hublock_hash = '%s' and (hubloc_flags & %d) limit 1",
+ intval(HUBLOC_FLAGS_PRIMARY)
+ );
+ }
+ elseif($addr) {
+ $x = q("select hubloc.* from xchan left join hubloc on xchan_hash = hubloc_hash
+ where xchan_addr = '%s' and (hubloc_flags & %d) limit 1",
+ dbesc($addr),
+ intval(HUBLOC_FLAGS_PRIMARY)
+ );
+ }
- if(local_user()) {
-
- if($hash) {
- $x = q("select xchan.xchan_url, hubloc.* from xchan left join hubloc on xchan_hash = hubloc_hash
- where hublock_hash = '%s' and (hubloc_flags & %d) limit 1",
- intval(HUBLOC_FLAGS_PRIMARY)
- );
- }
- elseif($addr) {
- $x = q("select hubloc.* from xchan left join hubloc on xchan_hash = hubloc_hash
- where xchan_addr = '%s' and (hubloc_flags & %d) limit 1",
- dbesc($addr),
- intval(HUBLOC_FLAGS_PRIMARY)
- );
+ if(! $x) {
+
+ // Finger them if they've never been seen here before
+
+ if($addr) {
+ $ret = zot_finger($addr,null);
+ if($ret['success']) {
+ $j = json_decode($ret['body'],true);
+ if($j)
+ import_xchan($j);
+ $x = q("select hubloc.* from xchan left join hubloc on xchan_hash = hubloc_hash
+ where xchan_addr = '%s' and (hubloc_flags & %d) limit 1",
+ dbesc($addr),
+ intval(HUBLOC_FLAGS_PRIMARY)
+ );
+ }
}
+ }
- if(! $x) {
- notice( t('Channel not found.') . EOL);
- return;
- }
+ if(! $x) {
+ notice( t('Channel not found.') . EOL);
+ return;
+ }
- if($x[0]['hubloc_url'] === z_root()) {
- $webbie = substr($x[0]['hubloc_addr'],0,strpos('@',$x[0]['hubloc_addr']));
- switch($dest) {
- case 'channel':
- $desturl = z_root() . '/channel/' . $webbie;
- break;
- case 'photos':
- $desturl = z_root() . '/photos/' . $webbie;
- break;
- case 'profile':
- $desturl = z_root() . '/profile/' . $webbie;
- break;
- default:
- $desturl = $dest;
- break;
- }
- // We are already authenticated on this site and a registered observer.
- // Just redirect.
- goaway($desturl);
+ if($x[0]['hubloc_url'] === z_root()) {
+ $webbie = substr($x[0]['hubloc_addr'],0,strpos('@',$x[0]['hubloc_addr']));
+ switch($dest) {
+ case 'channel':
+ $desturl = z_root() . '/channel/' . $webbie;
+ break;
+ case 'photos':
+ $desturl = z_root() . '/photos/' . $webbie;
+ break;
+ case 'profile':
+ $desturl = z_root() . '/profile/' . $webbie;
+ break;
+ default:
+ $desturl = $dest;
+ break;
}
+ // We are already authenticated on this site and a registered observer.
+ // Just redirect.
+ goaway($desturl);
+ }
- $channel = $a->get_channel();
+ if(local_user()) {
+ $channel = $a->get_channel();
$token = random_string();
- $token_sig = rsa_sign($token,$channel['channel_prvkey']);
+ $token_sig = base64url_encode(rsa_sign($token,$channel['channel_prvkey']));
$channel['token'] = $token;
$channel['token_sig'] = $token_sig;
@@ -73,25 +89,12 @@ function magic_init(&$a) {
dbesc(datetime_convert())
);
- $packet = zot_build_packet($channel,'auth',$recip,$x[0]['hubloc_sitekey'],$hash);
- $result = zot_zot($x[0]['hubloc_callback'],$packet);
- if($result['success']) {
- $j = json_decode($result['body'],true);
- if($j['iv']) {
- $y = aes_unencapsulate($j,$channel['prvkey']);
- $j = json_decode($y,true);
- }
- if($j['token'] && $j['ticket'] && $j['token'] === $token) {
- $r = q("delete from verify where token = '%s' and type = '%s' and channel = %d limit 1",
- dbesc($token),
- dbesc('auth'),
- intval($channel['channel_id'])
- );
- goaway($x[0]['callback'] . '?f=&ticket=' . $ticket . '&dest=' . $dest);
- }
- }
- goaway($dest);
+ goaway($x[0]['hubloc_callback'] . '/' . substr($x[0]['hubloc_addr'],0,strpos($x[0]['hubloc_addr'],'@'))
+ . '/?f=&auth=' . $channel['channel_address'] . '@' . $a->get_hostname()
+ . '&sec=' . $token . '&dest=' . $dest . '&version=' . ZOT_REVISION);
}
+ if(strpos($dest,'/'))
+ goaway($dest);
goaway(z_root());
}
diff --git a/mod/post.php b/mod/post.php
index ee21f2ffb..bfcc99022 100644
--- a/mod/post.php
+++ b/mod/post.php
@@ -6,6 +6,110 @@
require_once('include/zot.php');
+
+
+function post_init(&$a) {
+
+ // All other access to this endpoint is via the post method.
+ // Here we will pick out the magic auth params which arrive
+ // as a get request.
+
+ if(argc() > 1) {
+
+ $webbie = argv(1);
+
+ if(array_key_exists('auth',$_REQUEST)) {
+
+ $address = $_REQUEST['auth'];
+ $dest = $_REQUEST['dest'];
+ $sec = $_REQUEST['sec'];
+ $version = $_REQUEST['version'];
+
+ switch($dest) {
+ case 'channel':
+ $desturl = z_root() . '/channel/' . $webbie;
+ break;
+ case 'photos':
+ $desturl = z_root() . '/photos/' . $webbie;
+ break;
+ case 'profile':
+ $desturl = z_root() . '/profile/' . $webbie;
+ break;
+ default:
+ $desturl = $dest;
+ break;
+ }
+ $c = q("select * from channel where channel_address = '%s' limit 1",
+ dbesc($webbie)
+ );
+ if(! $c) {
+ logger('mod_zot: auth: unable to find channel ' . $webbie);
+ // They'll get a notice when they hit the page, we don't need two.
+ goaway($desturl);
+ }
+
+ // Try and find a hubloc for the person attempting to auth
+ $x = q("select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' limit 1",
+ dbesc($address)
+ );
+
+ if(! $x) {
+ // finger them if they can't be found.
+ $ret = zot_finger($addr,null);
+ if($ret['success']) {
+ $j = json_decode($ret['body'],true);
+ if($j)
+ import_xchan($j);
+ $x = q("select * from hubloc left join xchan on xchan_hash = hubloc_hash where hubloc_addr = '%s' limit 1",
+ dbesc($address)
+ );
+ }
+ }
+ if(! $x)
+ goaway($desturl);
+
+ // check credentials and access
+
+ // Auth packets MUST use ultra top-secret hush-hush mode
+
+ $p = zot_build_packet($c[0],$type = 'auth_check',array('guid' => $x[0]['hubloc_guid'],'guid_sig' => $x[0]['hubloc_guid_sig']), $x[0]['hubloc_prvkey'], $sec);
+ $result = zot_zot($x[0]['hubloc_url'],$p);
+
+ if($result['success']) {
+ $j = json_decode($result['body'],true);
+ if($j['result']) {
+ // everything is good... maybe
+ if(local_user()) {
+ notice( t('Remote authentication blocked. You are logged into this site locally. Please logout and retry') . EOL);
+ goaway($desturl);
+ }
+ // log them in
+ $_SESSION['authenticated'] = 1;
+ $_SESSION['visitor_id'] = $x[0]['xchan_hash'];
+ $a->set_observer($x[0]);
+ $a->set_groups(init_groups_visitor($_SESSION['visitor_id']));
+ notice(sprintf( t('Welcome %s. Remote authentication successful.'),$x[0]['xchan_name']));
+ }
+ }
+
+
+
+
+
+
+ goaway($desturl);
+ }
+
+ logger('mod_zot: invalid args: ' . print_r($a->argv,true));
+ killme();
+ }
+
+ return;
+}
+
+
+
+
function post_post(&$a) {
@@ -165,12 +269,51 @@ function post_post(&$a) {
}
- if($msgtype === 'auth') {
- logger('mod_post: auth: ' . print_r($data,true));
-
+ if($msgtype === 'auth_check') {
+ $arr = $data['sender'];
+ $sender_hash = base64url_encode(hash('whirlpool',$arr['guid'] . $arr['guid_sig'], true));
+ $y = q("select xchan_pubkey from xchan where xchan_hash = '%s' limit 1",
+ dbesc($sender_hash)
+ );
+ if((! $y) || (! rsa_verify($data['secret'],$data['secret_sig'],$y[0]['xchan_pubkey']))) {
+ logger('mod_zot: auth_check: sender not found or secret_sig invalid.');
+ json_return_and_die($ret);
+ }
+ if($data['recipients']) {
+
+ $arr = $data['recipients'][0];
+ $recip_hash = base64url_encode(hash('whirlpool',$arr['guid'] . $arr['guid_sig'], true));
+ $c = q("select channel_id from channel where channel_hash = '%s' limit 1",
+ dbesc($recip_hash)
+ );
+ if(! $c) {
+ logger('mod_zot: auth_check: recipient channel not found.');
+ json_return_and_die($ret);
+ }
+ $z = q("select id from verify where channel = %d and type = 'auth' and token = '%s' limit 1",
+ intval($c[0]['channel_id']),
+ dbesc($data['secret'])
+ );
+ if(! $z) {
+ logger('mod_zot: auth_check: verification key not found.');
+ json_return_and_die($ret);
+ }
+ $r = q("delete from verify where id = %d limit 1",
+ intval($z[0]['id'])
+ );
+
+ $ret['result'] = true;
+ json_return_and_die($ret);
+
+ }
+ json_return_and_die($ret);
}
-}
+ // catchall
+ json_return_and_die($ret);
+
+
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-04 05:35:25 +0000