CryoKey has uploaded a new change for review. https://gerrit.wikimedia.org/r/99692
Change subject: Support new centralized CryoKey Lite API ...................................................................... Support new centralized CryoKey Lite API Code from the original CryoKey.js is now available on the main CryoKey page. Therefore, to keep things up to date, we refer to that JS file for core functionality. Also, we make use of the new JSON redemption response to future-proof the extension. Change-Id: I22ef646953ef4346a498ab5382cc66ba6dd14046 --- M cryokey.js M cryokey.php 2 files changed, 43 insertions(+), 111 deletions(-) git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/CryoKey refs/changes/92/99692/1 diff --git a/cryokey.js b/cryokey.js index 78e9150..4748ba3 100644 --- a/cryokey.js +++ b/cryokey.js @@ -3,117 +3,19 @@ // MIT License - See LICENSE file for details. // -var CK_HOME = "https://www.cryokey.com";; - -// These placeholders will contain the actual ticket handlers. -var CK_HEAD = document.getElementsByTagName('head')[0]; -var CK_HANDLER = document.createElement('script'); -var CK_URL = document.URL; -var CK_ATTEMPTS = 0; - -// Insert the initially empty script block. -CK_HEAD.appendChild(CK_HANDLER); - -// Get an HTTP connection object. -function ck_get_connector() -{ - try { return new XMLHttpRequest(); } catch (error) { } - try { return new ActiveXObject("Msxml2.XMLHTTP"); } catch (error) { } - try { return new ActiveXObject("Microsoft.XMLHTTP"); } catch (error) { } - throw new Error("Could not create HTTP request object."); -} - -// Attempt to clear cached authentication information. -function ck_logout(_url) -{ - if (/MSIE ([0-9]{1,}[\.0-9]{0,})/.test(navigator.userAgent)) - document.execCommand('ClearAuthenticationCache'); - if (window.crypto && window.crypto.logout) - window.crypto.logout(); - window.location = _url; -} - // Initiate a log in attempt. Clear existing credentials before the // attempt. -function ck_initiate(_url, _ip, _pass, _start, _abort, _fail) +function ck_initiate(_url, _ip, _pass, _start, _fail) { - if (/(iPad|iPhone|iPod)/.test(navigator.userAgent)) - { - CK_ATTEMPTS = 1; - ck_ticket(_url, _ip, _pass, _start, _abort, _fail); - return; - } - if (/MSIE ([0-9]{1,}[\.0-9]{0,})/.test(navigator.userAgent)) - { - document.execCommand('ClearAuthenticationCache'); - CK_ATTEMPTS = 3; - ck_ticket(_url, _ip, _pass, _start, _abort, _fail); - return; - } - if (/Android/.test(navigator.userAgent)) - { - // Note: the CryoKey Android application must be available. - window.location = CK_HOME + "/private/ticket.php?mode=plain&url=" + escape(_url) + "&ip=" + escape(_ip) + "&pass=" + escape(_pass); - return; - } - if (window.crypto && window.crypto.logout) - { - window.crypto.logout(); - CK_ATTEMPTS = 3; - ck_ticket(_url, _ip, _pass, _start, _abort, _fail); - return; - } - - var flush = ck_get_connector(); - flush.onreadystatechange = function() - { - if (flush.readyState == 4) - { - CK_ATTEMPTS = 3; - ck_ticket(_url, _ip, _pass, _start, _abort, _fail); - } - } - flush.open("GET", CK_HOME + "/public/flush", true); - flush.send(); -} - -// Acquire a ticket from CryoKey's ticketing module. -function ck_ticket(_url, _ip, _pass, _start, _abort, _fail) -{ - var now = new Date().getTime() / 1000; - var ticketer = CK_HOME + "/private/ticket.php?mode=js&url=" + escape(_url) + "&ip=" + escape(_ip) + "&skew=" + now; + var ck = new CryoKey(_url, _ip); var status = document.getElementById("ck_message"); status.innerHTML = _start; - CK_ATTEMPTS--; - CK_URL = _pass; - CK_HEAD.removeChild(CK_HANDLER); - - CK_HANDLER = document.createElement('script'); - CK_HANDLER.type = "text/javascript"; - CK_HANDLER.onabort = function() + ck.onfail = function(_url) { - status.innerHTML = _abort; - } - CK_HANDLER.onerror = function() - { - if (CK_ATTEMPTS > 0) - ck_ticket(_url, _ip, _pass, _start, _abort, _fail); - else - status.innerHTML = _fail; - } - CK_HANDLER.src = ticketer; + status.innerHTML = _fail; + }; - CK_HEAD.appendChild(CK_HANDLER); -} - -// Complete authentication by passing the TicketID to the target -// service. -function ck_login(_tid) -{ - if (/\?/.test(CK_URL)) - window.location = CK_URL + "&cktid=" + escape(_tid); - else - window.location = CK_URL + "?cktid=" + escape(_tid); + ck.initiate(_pass); } diff --git a/cryokey.php b/cryokey.php index e65c39f..d6385dc 100644 --- a/cryokey.php +++ b/cryokey.php @@ -9,7 +9,7 @@ 'path' => __FILE__, 'name' => 'CryoKey', 'descriptionmsg' => 'cryokey-desc', - 'version' => '2.2', + 'version' => '2.3', 'author' => 'Authenticade LLC', 'url' => 'https://www.mediawiki.org/wiki/Extension:CryoKey' ); @@ -22,6 +22,7 @@ // Internal constant: home directory $CK_HOME = "https://www.cryokey.com";; +$CK_MSG = 'cryokey-label'; /** * The CryoKey JavaScript should always be available to handle @@ -31,8 +32,13 @@ */ function wgck_enscript(&$_page, &$_skin) { + global $CK_HOME; + + $cryokey = "{$CK_HOME}/cryokey.js"; + $_page->addHeadItem("cryokey", "<script type='text/javascript' src='{$cryokey}'></script>"); + $js = wgck_locate("cryokey.js"); - $_page->addHeadItem("cryokey", "<script type='text/javascript' src='{$js}'></script>"); + $_page->addHeadItem("ckauth", "<script type='text/javascript' src='{$js}'></script>"); return true; } @@ -44,6 +50,7 @@ { global $wgCKAutoRegister; global $wgScriptPath; + global $CK_MSG; // Check to see if the request includes a CryoKey ticket. if (isset($_GET['cktid'])) @@ -90,6 +97,10 @@ $request->setSessionData('wsToken', $_user->getToken(false)); return true; } + + // Ticket mismatch. + // TODO: hocy - redirect to login page? + $CK_MSG = 'cryokey-fail'; } // Authentication failed. Fall back. @@ -104,21 +115,22 @@ function wgck_form($_template) { global $wgScriptPath; + global $CK_MSG; - $ip = $_SERVER['REMOTE_ADDR']; + $ip = wgck_ip(); $icon = wgck_locate('ckicon.png'); $service = $wgScriptPath; $pass = $_SERVER['PHP_SELF']; $msg_start = wfMessage('cryokey-start'); - $msg_abort = wfMessage('cryokey-abort'); + //$msg_abort = wfMessage('cryokey-abort'); $msg_fail = wfMessage('cryokey-fail'); // Since these values (IP, service, and pass URL) come from the // server or API, we're assuming that they are valid and don't need // scrubbing. - $action = "javascript:ck_initiate('{$service}', '{$ip}', '{$pass}', '{$msg_start}', '{$msg_abort}', '{$msg_fail}');"; - $message = "<span id='ck_message'>" . wfMessage('cryokey-label') . "</span>"; + $action = "javascript:ck_initiate('{$service}', '{$ip}', '{$pass}', '{$msg_start}', '{$msg_fail}');"; + $message = "<span id='ck_message'>" . wfMessage($CK_MSG) . "</span>"; $extras = @$_template->data['extrafields'] . "<a href=\"{$action}\"><img src='{$icon}' width='16' height='16'/>{$message}</a>"; $_template->set('extrafields', $extras); @@ -130,10 +142,12 @@ */ function wgck_logout_link($_title, &$_url, $_query) { + /* if (($_title->isSpecial("UserLogout")) || ($_title->isSpecial("Userlogout"))) { $_url = "javascript:ck_logout('" . $_url . "');"; } + */ return true; } @@ -180,7 +194,23 @@ { global $CK_HOME; - return file_get_contents($CK_HOME . "/public/redeem.php?mode=name&tid=" . urlencode($_tid) . "&from=" . urlencode($_SERVER['REMOTE_ADDR']) . "&to=" . urlencode($_service)); + $ip = wgck_ip(); + $response = json_decode(file_get_contents($CK_HOME . "/public/redeem.php?mode=json&tid=" . urlencode($_tid) . "&from=" . urlencode($ip) . "&to=" . urlencode($_service))); + if (($response->ckfrom == $ip) || ($response->ckfrom == $response->ckto)) + return $response->ckname; + else + return NULL; +} +/** + * Try to determine the client's IP address. + */ +function wgck_ip() +{ + if (isset($_SERVER['HTTP_CLIENT_IP'])) + return $_SERVER['HTTP_CLIENT_IP']; + if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) + return $_SERVER['HTTP_X_FORWARDED_FOR']; + return $_SERVER['REMOTE_ADDR']; } $wgHooks['BeforePageDisplay'][] = 'wgck_enscript'; -- To view, visit https://gerrit.wikimedia.org/r/99692 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: newchange Gerrit-Change-Id: I22ef646953ef4346a498ab5382cc66ba6dd14046 Gerrit-PatchSet: 1 Gerrit-Project: mediawiki/extensions/CryoKey Gerrit-Branch: master Gerrit-Owner: CryoKey <[email protected]> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
