better handle missing auth header, set explicit response types to not get warnings...

[authserver.git] / app / api.php

diff --git a/app/api.php b/app/api.php
index f51f20198eda8c59c146e24d858c8e50e777a192..0efc179417910781b9d425af8c775126dead0bce 100644 (file)
--- a/app/api.php
+++ b/app/api.php
@@ -9,6 +9,13 @@
 
 // Include the common auth system files (including the OAuth2 Server object).
 require_once(__DIR__.'/authsystem.inc.php');
 
 // Include the common auth system files (including the OAuth2 Server object).
 require_once(__DIR__.'/authsystem.inc.php');

+if ($settings['piwik_enabled']) {
+  // We do not send out an HTML file, so we need to do the Piwik tracking ourselves.
+  // Init is done here, actual tracking before exit.
+  require_once($settings['piwik_tracker_path'].'PiwikTracker.php');
+  PiwikTracker::$URL = ((strpos($settings['piwik_url'], '://') === false) ? 'http://localhost' : '' ).$settings['piwik_url'];
+  $piwikTracker = new PiwikTracker($idSite = $settings['piwik_site_id']);
+}

 
 $errors = $utils->checkForSecureConnection();
 $utils->sendSecurityHeaders();
 
 $errors = $utils->checkForSecureConnection();
 $utils->sendSecurityHeaders();


@@ -17,7 +24,13 @@ if (!count($errors)) {
   // Handle a request to a resource and authenticate the access token
   $token_OK = $server->verifyResourceRequest(OAuth2\Request::createFromGlobals());
   if (!$token_OK) {
   // Handle a request to a resource and authenticate the access token
   $token_OK = $server->verifyResourceRequest(OAuth2\Request::createFromGlobals());
   if (!$token_OK) {

-    $server->getResponse()->send();
+    $response = $server->getResponse();
+    if (!count($response->getParameters())) {
+      // We get an empty response if we don't get any auth header. Let's actually note that explicitly.
+      $response->setError($response->getStatusCode(), 'auth_missing', 'Authentication missing');
+    }
+    $response->send();
+    if ($settings['piwik_enabled']) { $piwikTracker->doTrackPageView('API Request: Bad Token'); }

     exit();
   }
   $token = $server->getAccessTokenData(OAuth2\Request::createFromGlobals());
     exit();
   }
   $token = $server->getAccessTokenData(OAuth2\Request::createFromGlobals());


@@ -59,7 +72,7 @@ if (!count($errors)) {
                                   'error_description' => 'The user the access token is connected to was not recognized.')));
         }
         else {
                                   'error_description' => 'The user the access token is connected to was not recognized.')));
         }
         else {

-          if (in_array($user['email'], $utils->client_reg_email_whitelist)) {
+          if (($utils->client_reg_email_whitelist === false) || (in_array($user['email'], $utils->client_reg_email_whitelist))) {

             if (strlen(@$_GET['client_id']) >= 5) {
               $result = $db->prepare('SELECT `client_id`,`user_id` FROM `oauth_clients` WHERE `client_id` = :clientid;');
               $result->execute(array(':clientid' => $_GET['client_id']));
             if (strlen(@$_GET['client_id']) >= 5) {
               $result = $db->prepare('SELECT `client_id`,`user_id` FROM `oauth_clients` WHERE `client_id` = :clientid;');
               $result->execute(array(':clientid' => $_GET['client_id']));


@@ -141,4 +154,7 @@ else {
   print(json_encode(array('error' => 'insecure_connection',
                           'error_description' => 'Your connection is insecure. The API can only be accessed on secure connections.')));
 }
   print(json_encode(array('error' => 'insecure_connection',
                           'error_description' => 'Your connection is insecure. The API can only be accessed on secure connections.')));
 }

+if ($settings['piwik_enabled']) {
+  $piwikTracker->doTrackPageView('API Request'.(strlen($token['scope'])?': '.$token['scope']:''));
+}

 ?>
 ?>