Friendica/friendica-github
1
0
Fork 0
mirror of https://github.com/friendica/friendica synced 2025-04-21 03:50:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

Rearranged scope check

Browse source
This commit is contained in:
Michael 2021-06-08 09:11:56 +00:00
parent 95cac04540
commit 9720ee2c20
3 changed files with 36 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

44
src/Module/BaseApi.php
View file

@ -34,13 +34,9 @@ require_once __DIR__ . '/../../include/api.php';
class BaseApi extends BaseModule
{
/** @deprecated Use OAuth class constant */
const SCOPE_READ = 'read';
/** @deprecated Use OAuth class constant */
const SCOPE_WRITE = 'write';
/** @deprecated Use OAuth class constant */
const SCOPE_FOLLOW = 'follow';
/** @deprecated Use OAuth class constant */
const SCOPE_PUSH = 'push';
/**
@ -173,24 +169,14 @@ class BaseApi extends BaseModule
}
/**
* @deprecated Use checkAllowedScope instead
* Log in user via OAuth or Basic HTTP Auth.
*
* @param string $scope the requested scope (read, write, follow)
*/
protected static function login(string $scope)
{
$uid = OAuth::getCurrentUserID();
if (!empty($uid)) {
if (!OAuth::isAllowedScope($scope)) {
DI::mstdnError()->Forbidden();
}
}
if (empty($uid)) {
// The execution stops here if no one is logged in
BasicAuth::getCurrentUserID(true);
}
self::checkAllowedScope($scope);
}
/**
@ -225,6 +211,32 @@ class BaseApi extends BaseModule
return (int)$uid;
}
/**
* Check if the provided scope does exist.
* halts execution on missing scope or when not logged in.
*
* @param string $scope the requested scope (read, write, follow, push)
*/
public static function checkAllowedScope(string $scope)
{
$token = self::getCurrentApplication();
if (empty($token)) {
Logger::notice('Empty application token');
DI::mstdnError()->Forbidden();
}
if (!isset($token[$scope])) {
Logger::warning('The requested scope does not exist', ['scope' => $scope, 'application' => $token]);
DI::mstdnError()->Forbidden();
}
if (empty($token[$scope])) {
Logger::warning('The requested scope is not allowed', ['scope' => $scope, 'application' => $token]);
DI::mstdnError()->Forbidden();
}
}
/**
* Get user info array.
*