Skip to content

Commit c00534c

Browse files
author
csteipp
committed
Add clean redir url, web demo
Add a client redirect url option, so we can use clean urls required by mobile, etc. Also added a web authentication demo.
1 parent 9824496 commit c00534c

File tree

3 files changed

+107
-1
lines changed

3 files changed

+107
-1
lines changed

‎MWOAuthClient.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ class MWOAuthClientConfig {
1616
// Canonical server url, used to check /identify's iss
1717
public $canonicalServerUrl;
1818

19+
// Url that the user is sent to. Can be different from
20+
// $endpointURL to play nice with MobileFrontend, etc.
21+
public $redirURL = null;
22+
23+
// Use https when calling the server.
24+
// TODO: detect this from $endpointURL
1925
public $useSSL = true;
2026

2127
// If you're testing against a server with self-signed certificates, you
@@ -80,7 +86,8 @@ public function initiate() {
8086
throw new Exception( "Callback wasn't confirmed" );
8187
}
8288
$requestToken = new OAuthToken( $return->key, $return->secret );
83-
$url = $this->config->endpointURL . "/authorize&oauth_token={$requestToken->key}&oauth_consumer_key={$this->consumerToken->key}";
89+
$url = $this->config->redirURL ?: $this->config->endpointURL . "/authorize&";
90+
$url .= "oauth_token={$requestToken->key}&oauth_consumer_key={$this->consumerToken->key}";
8491

8592
return array( $url, $requestToken );
8693
}

‎demo.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
false // do we validate the SSL certificate? Always use 'true' in production.
1616
);
1717
$config->canonicalServerUrl = 'http://localhost';
18+
$config->redirURL = 'https://localhost/view/Special:OAuth?';
1819

1920
$cmrToken = new OAuthToken( $consumerKey, $consumerSecret );
2021
$client = new MWOAuthClient( $config, $cmrToken );

‎webdemo.php‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
<?php
2+
3+
include 'MWOAuthClient.php';
4+
$consumerKey = '';
5+
$consumerSecret = '';
6+
7+
// Configure the connection to the wiki you want to use. Passing title=Special:OAuth as a
8+
// GET parameter makes the signature easier. Otherwise you need to call
9+
// $client->setExtraParam('title','Special:OAuth/whatever') for each step.
10+
// If your wiki uses wgSecureLogin, the canonicalServerUrl will point to http://
11+
$config = new MWOAuthClientConfig(
12+
'http://en.wikipedia.beta.wmflabs.org/w/index.php?title=Special:OAuth', // url to use
13+
false, // do we use SSL? (we should probably detect that from the url)
14+
false // do we validate the SSL certificate? Always use 'true' in production.
15+
);
16+
$config->canonicalServerUrl = 'http://en.wikipedia.beta.wmflabs.org';
17+
// Optional clean url here (i.e., to work with mobile), otherwise the
18+
// base url just has /authorize& added
19+
$config->redirURL = 'http://en.wikipedia.beta.wmflabs.org/wiki/Special:OAuth/authorize?';
20+
$cmrToken = new OAuthToken( $consumerKey, $consumerSecret );
21+
$client = new MWOAuthClient( $config, $cmrToken );
22+
23+
session_start();
24+
25+
if ( !isset( $_GET['action'] ) ) {
26+
echo "<html><body><p><a href='webdemo.php?action=init'>Start OAuth</a></p></body></html>";
27+
exit;
28+
} else {
29+
$action = $_GET['action'];
30+
}
31+
32+
33+
if ( $action == 'init' ) {
34+
35+
// Step 1 - Get a request token
36+
list( $redir, $requestToken ) = $client->initiate();
37+
$_SESSION['oauthreqtoken'] = "{$requestToken->key}:{$requestToken->secret}";
38+
39+
// Step 2 - Have the user authorize your app.
40+
header( "Location: $redir" );
41+
exit;
42+
43+
} elseif ( $action == 'finish' ) {
44+
45+
$verifyCode = $_GET['oauth_verifier'];
46+
$recKey = $_GET['oauth_token'];
47+
list( $requestKey, $requestSecret ) = explode( ':', $_SESSION['oauthreqtoken'] );
48+
$requestToken = new OAuthToken( $requestKey, $requestSecret );
49+
unset( $_SESSION['oauthreqtoken'] );
50+
51+
//check for csrf
52+
if ( $requestKey !== $recKey ) {
53+
die( "CSRF detected" );
54+
}
55+
56+
// Step 3 - Exchange the request token and verification code for an access token
57+
$accessToken = $client->complete( $requestToken, $verifyCode );
58+
59+
// You're done! Setup your application's session state. Keep the accessToken
60+
// to use for later calls by your application into MediaWiki.
61+
session_regenerate_id();
62+
$identity = $client->identify( $accessToken );
63+
$_SESSION['oauthtoken'] = "{$accessToken->key}:{$accessToken->secret}";
64+
$_SESSION['username'] = $identity->username;
65+
66+
// Redirect to your application's main entry point
67+
header( "Location: webdemo.php?action=info" );
68+
69+
exit;
70+
} elseif ( $action == 'info' ) {
71+
// This is what you're app should do for logged in users
72+
if ( !isset( $_SESSION['username'] ) || !isset( $_SESSION['oauthtoken'] ) ) {
73+
die( "Lost Session, <a href='webdemo.php?action=init'>start over</a>" );
74+
}
75+
76+
list( $accessKey, $accessSecret ) = explode( ':', $_SESSION['oauthtoken'] );
77+
$accessToken = new OAuthToken( $accessKey, $accessSecret );
78+
79+
// Check their current identity
80+
$identity = $client->identify( $accessToken );
81+
echo "<pre>\n";
82+
echo "Authenticated as user {$identity->username}\n";
83+
84+
// Do a simple API call as the user
85+
echo "Getting user info: ";
86+
echo $client->makeOAuthCall(
87+
$accessToken,
88+
'https://localhost/wiki/api.php?action=query&meta=userinfo&uiprop=rights&format=json'
89+
);
90+
echo "</pre>\n";
91+
echo "<a href='webdemo.php?action=logout'>Logout</a>";
92+
exit;
93+
94+
} elseif ( $action == 'logout' ) {
95+
session_destroy();
96+
echo "<a href='webdemo.php?action=init'>Start Over</a>";
97+
}
98+

0 commit comments

Comments
 (0)