Subversion Repositories oidplus

Rev

Rev 564 | Go to most recent revision | Blame | Last modification | View Log | RSS feed

  1. <?php
  2.  
  3. /*
  4.  * OIDplus 2.0
  5.  * Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft
  6.  *
  7.  * Licensed under the Apache License, Version 2.0 (the "License");
  8.  * you may not use this file except in compliance with the License.
  9.  * You may obtain a copy of the License at
  10.  *
  11.  *     http://www.apache.org/licenses/LICENSE-2.0
  12.  *
  13.  * Unless required by applicable law or agreed to in writing, software
  14.  * distributed under the License is distributed on an "AS IS" BASIS,
  15.  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16.  * See the License for the specific language governing permissions and
  17.  * limitations under the License.
  18.  */
  19.  
  20. # More information about the OAuth2 implementation:
  21. # - https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow
  22. # - https://developers.facebook.com/tools/explorer/
  23.  
  24. require_once __DIR__ . '/../../../includes/oidplus.inc.php';
  25.  
  26. OIDplus::init(true);
  27. set_exception_handler(array('OIDplusGui', 'html_exception_handler'));
  28.  
  29. if (OIDplus::baseConfig()->getValue('DISABLE_PLUGIN_OIDplusPagePublicLoginFacebook', false)) {
  30.         throw new OIDplusException(_L('This plugin was disabled by the system administrator!'));
  31. }
  32.  
  33. if (!OIDplus::baseConfig()->getValue('FACEBOOK_OAUTH2_ENABLED', false)) {
  34.         throw new OIDplusException(_L('Facebook OAuth authentication is disabled on this system.'));
  35. }
  36.  
  37. _CheckParamExists($_GET, 'code');
  38. _CheckParamExists($_GET, 'state');
  39. _CheckParamExists($_COOKIE, 'csrf_token_weak');
  40.  
  41. if ($_GET['state'] != $_COOKIE['csrf_token_weak']) {
  42.         die(_L('Wrong CSRF Token'));
  43. }
  44.  
  45. if (!function_exists('curl_init')) {
  46.         die(_L('The "%1" PHP extension is not installed at your system. Please enable the PHP extension <code>%2</code>.','CURL','php_curl'));
  47. }
  48.  
  49. // Get access token
  50.  
  51. $ch = curl_init();
  52. if (ini_get('curl.cainfo') == '') curl_setopt($ch, CURLOPT_CAINFO, OIDplus::localpath() . '3p/certs/cacert.pem');
  53. curl_setopt($ch, CURLOPT_URL,"https://graph.facebook.com/v8.0/oauth/access_token?".
  54.         "client_id=".urlencode(OIDplus::baseConfig()->getValue('FACEBOOK_OAUTH2_CLIENT_ID'))."&".
  55.         "redirect_uri=".urlencode(OIDplus::webpath(__DIR__,false).'oauth.php')."&".
  56.         "client_secret=".urlencode(OIDplus::baseConfig()->getValue('FACEBOOK_OAUTH2_CLIENT_SECRET'))."&".
  57.         "code=".$_GET['code']
  58. );
  59. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  60. $cont = curl_exec($ch);
  61. curl_close($ch);
  62. $data = json_decode($cont,true);
  63. if (isset($data['error'])) {
  64.         echo '<h2>Error at step 2</h2>';
  65.         echo '<p>'.$data['error']['message'].'</p>';
  66.         die();
  67. }
  68. $access_token = $data['access_token'];
  69.  
  70. // Get user infos
  71.  
  72. $ch = curl_init();
  73. if (ini_get('curl.cainfo') == '') curl_setopt($ch, CURLOPT_CAINFO, OIDplus::localpath() . '3p/certs/cacert.pem');
  74. curl_setopt($ch, CURLOPT_URL,"https://graph.facebook.com/v8.0/me?".
  75.         "fields=id,email,name&".
  76.         "access_token=".urlencode($access_token)
  77. );
  78. curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  79. $cont = curl_exec($ch);
  80. curl_close($ch);
  81. $data = json_decode($cont,true);
  82. if (isset($data['error'])) {
  83.         throw new OIDplusException(_L('Error receiving the authentication token from %1: %2','Facebook',$data['error']['message']));
  84. }
  85. $personal_name = $data['name'];
  86. $email = !isset($data['email']) ? '' : $data['email'];
  87. if (empty($email)) {
  88.         throw new OIDplusException(_L('Your Facebook account does not have an email address.'));
  89. }
  90.  
  91. // Everything's done! Now login and/or create account
  92.  
  93. if (!empty($email)) {
  94.         $ra = new OIDplusRA($email);
  95.         if (!$ra->existing()) {
  96.                 $ra->register_ra(null); // create a user account without password
  97.  
  98.                 OIDplus::db()->query("update ###ra set ra_name = ?, personal_name = ? where email = ?", array($personal_name, $personal_name, $email));
  99.  
  100.                 OIDplus::logger()->log("[INFO]RA($email)!", "RA '$email' was created because of successful Facebook OAuth2 login");
  101.         }
  102.  
  103.         OIDplus::authUtils()->raLoginEx($email, $remember_me=false, 'Facebook-OAuth2');
  104.  
  105.         OIDplus::db()->query("UPDATE ###ra set last_login = ".OIDplus::db()->sqlDate()." where email = ?", array($email));
  106.  
  107.         // Go back to OIDplus
  108.  
  109.         header('Location:'.OIDplus::webpath(null,false));
  110. }
  111.