bitPickups/friendica_2020-09-1_sharedHosting
1
0
Fork 0
Code Pull requests Activity

port hubzillas OpenWebAuth - remote authentification

Browse source
This commit is contained in:
rabuzarus 2018-06-18 23:05:44 +02:00
commit 1c7f4e3c63
16 changed files with 1151 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

42
index.php
View file

@ -121,25 +121,35 @@ if ((x($_SESSION, 'language')) && ($_SESSION['language'] !== $lang)) {
L10n::loadTranslationTable($lang);
}
if ((x($_GET, 'zrl')) && $a->mode == App::MODE_NORMAL) {
// Only continue when the given profile link seems valid
// Valid profile links contain a path with "/profile/" and no query parameters
if ((parse_url($_GET['zrl'], PHP_URL_QUERY) == "")
&& strstr(parse_url($_GET['zrl'], PHP_URL_PATH), "/profile/")
) {
$_SESSION['my_url'] = $_GET['zrl'];
$a->query_string = preg_replace('/[\?&]zrl=(.*?)([\?&]|$)/is', '', $a->query_string);
Profile::zrlInit($a);
} else {
// Someone came with an invalid parameter, maybe as a DDoS attempt
// We simply stop processing here
logger("Invalid ZRL parameter ".$_GET['zrl'], LOGGER_DEBUG);
header('HTTP/1.1 403 Forbidden');
echo "<h1>403 Forbidden</h1>";
killme();
if ((x($_GET,'zrl')) && $a->mode == App::MODE_NORMAL) {
$a->query_string = Profile::stripZrls($a->query_string);
if (!local_user()) {
// Only continue when the given profile link seems valid
// Valid profile links contain a path with "/profile/" and no query parameters
if ((parse_url($_GET['zrl'], PHP_URL_QUERY) == "") &&
strstr(parse_url($_GET['zrl'], PHP_URL_PATH), "/profile/")) {
if ($_SESSION["visitor_home"] != $_GET["zrl"]) {
$_SESSION['my_url'] = $_GET['zrl'];
$_SESSION['authenticated'] = 0;
}
Profile::zrlInit($a);
} else {
// Someone came with an invalid parameter, maybe as a DDoS attempt
// We simply stop processing here
logger("Invalid ZRL parameter " . $_GET['zrl'], LOGGER_DEBUG);
header('HTTP/1.1 403 Forbidden');
echo "<h1>403 Forbidden</h1>";
killme();
}
}
}
if ((x($_GET,'owt')) && $a->mode == App::MODE_NORMAL) {
$token = $_GET['owt'];
$a->query_string = Profile::stripQueryParam($a->query_string, 'owt');
Profile::owtInit($token);
}
/**
* For Mozilla auth manager - still needs sorting, and this might conflict with LRDD header.
* Apache/PHP lumps the Link: headers into one - and other services might not be able to parse it