X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/c99d26030e6ddd7a21932e98e40a8df7d896886d..c7bdebaaf134729356852918b387071c92f85e72:/IkiWiki/Plugin/openid.pm?ds=sidebyside diff --git a/IkiWiki/Plugin/openid.pm b/IkiWiki/Plugin/openid.pm index b1a9a7a15..35ef52a58 100644 --- a/IkiWiki/Plugin/openid.pm +++ b/IkiWiki/Plugin/openid.pm @@ -7,30 +7,18 @@ use strict; use IkiWiki 3.00; sub import { - add_underlay("openid-selector"); - hook(type => "checkconfig", id => "openid", call => \&checkconfig); hook(type => "getsetup", id => "openid", call => \&getsetup); hook(type => "auth", id => "openid", call => \&auth); hook(type => "formbuilder_setup", id => "openid", call => \&formbuilder_setup, last => 1); -} - -sub checkconfig () { - if ($config{cgi}) { - # Intercept normal signin form, so the openid selector - # can be displayed. - # - # When other auth hooks are registered, give the selector - # a reference to the normal signin form. - require IkiWiki::CGI; - my $real_cgi_signin; - if (keys %{$IkiWiki::hooks{auth}} > 1) { - $real_cgi_signin=\&IkiWiki::cgi_signin; - } - inject(name => "IkiWiki::cgi_signin", call => sub ($$) { - openid_selector($real_cgi_signin, @_); - }); - } + IkiWiki::loadplugin("emailauth"); + IkiWiki::loadplugin("loginselector"); + IkiWiki::Plugin::loginselector::register_login_plugin( + "openid", + \&openid_setup, + \&openid_check_input, + \&openid_auth, + ); } sub getsetup () { @@ -54,38 +42,34 @@ sub getsetup () { }, } -sub openid_selector { - my $real_cgi_signin=shift; - my $q=shift; - my $session=shift; - - my $openid_url=$q->param('openid_identifier'); - my $openid_error; +sub openid_setup ($$) { + my $q=shift; + my $template=shift; - if (! load_openid_module()) { - if ($real_cgi_signin) { - $real_cgi_signin->($q, $session); - exit; + if (load_openid_module()) { + my $openid_url=$q->param('openid_identifier'); + if (defined $openid_url) { + $template->param(openid_url => $openid_url); } - error(sprintf(gettext("failed to load openid module: "), @_)); + return 1; } - elsif (defined $q->param("action") && $q->param("action") eq "verify") { - validate($q, $session, $openid_url, sub { - $openid_error=shift; - }); + else { + return 0; } +} - my $template=IkiWiki::template("openid-selector.tmpl"); - $template->param( - cgiurl => $config{cgiurl}, - (defined $openid_error ? (openid_error => $openid_error) : ()), - (defined $openid_url ? (openid_url => $openid_url) : ()), - ($real_cgi_signin ? (nonopenidform => $real_cgi_signin->($q, $session, 1)) : ()), - ); +sub openid_check_input ($) { + my $q=shift; + my $openid_url=$q->param('openid_identifier'); + defined $q->param("action") && $q->param("action") eq "verify" && defined $openid_url && length $openid_url; +} - IkiWiki::printheader($session); - print IkiWiki::misctemplate("signin", $template->output); - exit; +sub openid_auth ($$$$) { + my $q=shift; + my $session=shift; + my $errordisplayer=shift; + my $openid_url=$q->param('openid_identifier'); + validate($q, $session, $openid_url, $errordisplayer); } sub formbuilder_setup (@) { @@ -99,10 +83,10 @@ sub formbuilder_setup (@) { IkiWiki::openiduser($session->param("name"))) { $form->field(name => "openid_identifier", disabled => 1, label => htmllink("", "", "ikiwiki/OpenID", noimageinline => 1), - value => $session->param("name"), - size => length($session->param("name")), force => 1, - fieldset => "login"); - $form->field(name => "email", type => "hidden"); + value => "", + size => 1, force => 1, + fieldset => "login", + comment => $session->param("name")); } } @@ -117,7 +101,9 @@ sub validate ($$$;$) { my $claimed_identity = $csr->claimed_identity($openid_url); if (! $claimed_identity) { if ($errhandler) { - $errhandler->($csr->err); + if (ref($errhandler) eq 'CODE') { + $errhandler->($csr->err); + } return 0; } else { @@ -148,14 +134,14 @@ sub validate ($$$;$) { } my $cgiurl=$config{openid_cgiurl}; - $cgiurl=$config{cgiurl} if ! defined $cgiurl; + $cgiurl=$q->url if ! defined $cgiurl; my $trust_root=$config{openid_realm}; $trust_root=$cgiurl if ! defined $trust_root; my $check_url = $claimed_identity->check_url( - return_to => "$cgiurl?do=postsignin", - trust_root => $trust_root, + return_to => auto_upgrade_https($q, "$cgiurl?do=postsignin"), + trust_root => auto_upgrade_https($q, $trust_root), delayed_return => 1, ); # Redirect the user to the OpenID server, which will @@ -175,7 +161,7 @@ sub auth ($$) { IkiWiki::redirect($q, $setup_url); } elsif ($csr->user_cancel) { - IkiWiki::redirect($q, $config{url}); + IkiWiki::redirect($q, IkiWiki::baseurl(undef)); } elsif (my $vident = $csr->verified_identity) { $session->param(name => $vident->url); @@ -211,7 +197,8 @@ sub auth ($$) { } } if (defined $nickname) { - $session->param(nickname => $nickname); + $session->param(nickname => + Encode::decode_utf8($nickname)); } } else { @@ -220,7 +207,7 @@ sub auth ($$) { } elsif (defined $q->param('openid_identifier')) { # myopenid.com affiliate support - validate($q, $session, $q->param('openid_identifier')); + validate($q, $session, scalar $q->param('openid_identifier')); } } @@ -228,16 +215,17 @@ sub getobj ($$) { my $q=shift; my $session=shift; + eval q{use Net::INET6Glue::INET_is_INET6}; # may not be available eval q{use Net::OpenID::Consumer}; error($@) if $@; my $ua; eval q{use LWPx::ParanoidAgent}; if (! $@) { - $ua=LWPx::ParanoidAgent->new; + $ua=LWPx::ParanoidAgent->new(agent => $config{useragent}); } else { - $ua=LWP::UserAgent->new; + $ua=useragent(); } # Store the secret in the session. @@ -248,16 +236,25 @@ sub getobj ($$) { } my $cgiurl=$config{openid_cgiurl}; - $cgiurl=$config{cgiurl} if ! defined $cgiurl; + $cgiurl=$q->url if ! defined $cgiurl; return Net::OpenID::Consumer->new( ua => $ua, args => $q, consumer_secret => sub { return shift()+$secret }, - required_root => $cgiurl, + required_root => auto_upgrade_https($q, $cgiurl), ); } +sub auto_upgrade_https { + my $q=shift; + my $url=shift; + if ($q->https()) { + $url=~s/^http:/https:/i; + } + return $url; +} + sub load_openid_module { # Give up if module is unavailable to avoid needing to depend on it. eval q{use Net::OpenID::Consumer};