Friendica/friendica-github
1
0
Fork 0
mirror of https://github.com/friendica/friendica synced 2025-05-21 05:04:12 +02:00
Code Issues Projects Releases Packages Wiki Activity

Rearranged scope check

Browse source
This commit is contained in:
Michael 2021-06-08 09:11:56 +00:00
parent 95cac04540
commit 9720ee2c20
3 changed files with 36 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

45
src/Security/OAuth.php
View file

@ -24,6 +24,7 @@ namespace Friendica\Security;
use Friendica\Core\Logger;
use Friendica\Database\Database;
use Friendica\Database\DBA;
use Friendica\Module\BaseApi;
use Friendica\Util\DateTimeFormat;
/**
@ -31,11 +32,6 @@ use Friendica\Util\DateTimeFormat;
*/
class OAuth
{
const SCOPE_READ = 'read';
const SCOPE_WRITE = 'write';
const SCOPE_FOLLOW = 'follow';
const SCOPE_PUSH = 'push';
/**
* @var bool|int
*/
@ -78,35 +74,6 @@ class OAuth
return self::$current_token;
}
/**
* Check if the provided scope does exist
*
* @param string $scope the requested scope (read, write, follow, push)
*
* @return bool "true" if the scope is allowed
*/
public static function isAllowedScope(string $scope)
{
$token = self::getCurrentApplicationToken();
if (empty($token)) {
Logger::notice('Empty application token');
return false;
}
if (!isset($token[$scope])) {
Logger::warning('The requested scope does not exist', ['scope' => $scope, 'application' => $token]);
return false;
}
if (empty($token[$scope])) {
Logger::warning('The requested scope is not allowed', ['scope' => $scope, 'application' => $token]);
return false;
}
return true;
}
/**
* Get the user token via the Bearer token
*
@ -200,13 +167,13 @@ class OAuth
'code' => $code,
'access_token' => $access_token,
'scopes' => $scope,
'read' => (stripos($scope, self::SCOPE_READ) !== false),
'write' => (stripos($scope, self::SCOPE_WRITE) !== false),
'follow' => (stripos($scope, self::SCOPE_FOLLOW) !== false),
'push' => (stripos($scope, self::SCOPE_PUSH) !== false),
'read' => (stripos($scope, BaseApi::SCOPE_READ) !== false),
'write' => (stripos($scope, BaseApi::SCOPE_WRITE) !== false),
'follow' => (stripos($scope, BaseApi::SCOPE_FOLLOW) !== false),
'push' => (stripos($scope, BaseApi::SCOPE_PUSH) !== false),
'created_at' => DateTimeFormat::utcNow(DateTimeFormat::MYSQL)];
foreach ([self::SCOPE_READ, self::SCOPE_WRITE, self::SCOPE_WRITE, self::SCOPE_PUSH] as $scope) {
foreach ([BaseApi::SCOPE_READ, BaseApi::SCOPE_WRITE, BaseApi::SCOPE_WRITE, BaseApi::SCOPE_PUSH] as $scope) {
if ($fields[$scope] && !$application[$scope]) {
Logger::warning('Requested token scope is not allowed for the application', ['token' => $fields, 'application' => $application]);
}