diff --git a/login-github.php b/login-github.php index 4dd89bf..51bcdd1 100644 --- a/login-github.php +++ b/login-github.php @@ -9,11 +9,13 @@ define('CLIENT_ENABLED', get_option('wpoa_github_api_enabled')); define('CLIENT_ID', get_option('wpoa_github_api_id')); define('CLIENT_SECRET', get_option('wpoa_github_api_secret')); +define('RESTRICT_ORGANISATION', get_option('wpoa_github_api_organisation')); define('REDIRECT_URI', rtrim(site_url(), '/') . '/'); -define('SCOPE', 'user'); // PROVIDER SPECIFIC: "user" is the minimum scope required to get the user's id from Github +define('SCOPE', ''); // PROVIDER SPECIFIC: Empty string gives us everything we need and is read only. define('URL_AUTH', "https://github.com/login/oauth/authorize?"); define('URL_TOKEN', "https://github.com/login/oauth/access_token?"); define('URL_USER', "https://api.github.com/user?"); +define('URL_ORGANISATION', "https://api.github.com/orgs/".RESTRICT_ORGANISATION."/members?"); # END OF DEFINE THE OAUTH PROVIDER AND SETTINGS TO USE # // remember the user's last url so we can redirect them back to there after the login ends: @@ -142,6 +144,7 @@ function get_oauth_identity($wpoa) { 'access_token' => $_SESSION['WPOA']['ACCESS_TOKEN'], // PROVIDER SPECIFIC: the access token is passed to Github using this key name ); $url_params = http_build_query($params); + // perform the http request: switch (strtolower(HTTP_UTIL)) { case 'curl': @@ -154,6 +157,18 @@ function get_oauth_identity($wpoa) { curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); $result_obj = json_decode($result, true); + + // Find organisation members + if(strlen(RESTRICT_ORGANISATION) > 0){ + $m_url = URL_ORGANISATION . $url_params; // TODO: we probably want to send this using a curl_setopt... + $m_curl = curl_init(); + curl_setopt($m_curl, CURLOPT_URL, $m_url); + curl_setopt($m_curl, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']); + curl_setopt($m_curl, CURLOPT_RETURNTRANSFER, 1); + $members = curl_exec($m_curl); + $members_obj = json_decode($members, true); + } + break; case 'stream-context': $url = rtrim(URL_USER, "?"); @@ -164,23 +179,61 @@ function get_oauth_identity($wpoa) { 'header' => "Authorization: token " . $_SESSION['WPOA']['ACCESS_TOKEN'], ) ); - $context = $context = stream_context_create($opts); + $context = stream_context_create($opts); $result = @file_get_contents($url, false, $context); if ($result === false) { $wpoa->wpoa_end_login("Sorry, we couldn't log you in. Could not retrieve user identity via stream context. Please notify the admin or try again later."); } $result_obj = json_decode($result, true); + + // Find organisation members + if(strlen(RESTRICT_ORGANISATION) > 0){ + $m_url = rtrim(URL_ORGANISATION, "?"); + $members = @file_get_contents($m_url, false, $context); + if ($members === false) { + $wpoa->wpoa_end_login("Sorry, we couldn't find the GitHub organisation members list. Please notify the admin or try again later."); + } + $members_obj = json_decode($result, true); + } + break; } + + // GitHub organisation membership check + if(strlen(RESTRICT_ORGANISATION) > 0){ + $has_membership = false; + foreach($members_obj as $member){ + if(isset($member['id']) && $member['id'] == $result_obj['id']){ + $has_membership = true; + } + } + if(!$has_membership){ + $wpoa->wpoa_end_login("Sorry, you need to be a member of the ".RESTRICT_ORGANISATION." GitHub organisation to log into this site."); + } + } + + // Check that we have the user ID + if(!isset($result_obj['id']) or strlen($result_obj['id']) == 0){ + $wpoa->wpoa_end_login("Error - could not find the user ID from GitHub."); + } + // parse and return the user's oauth identity: $oauth_identity = array(); $oauth_identity['provider'] = $_SESSION['WPOA']['PROVIDER']; $oauth_identity['id'] = $result_obj['id']; // PROVIDER SPECIFIC: this is how Github returns the user's unique id //$oauth_identity['email'] = $result_obj['email']; //PROVIDER SPECIFIC: this is how Github returns the email address + + // Bonus data from GitHub + $oauth_identity['oa_login'] = $result_obj['login']; + $oauth_identity['oa_email'] = $result_obj['email']; + $oauth_identity['oa_nicename'] = $result_obj['name']; + $oauth_identity['oa_desc'] = $result_obj['bio']; + $oauth_identity['oa_url'] = $result_obj['blog']; + if (!$oauth_identity['id']) { $wpoa->wpoa_end_login("Sorry, we couldn't log you in. User identity was not found. Please notify the admin or try again later."); } return $oauth_identity; } # END OF AUTHENTICATION FLOW HELPER FUNCTIONS # -?> \ No newline at end of file +?> diff --git a/register.php b/register.php index d3a93a8..0c6ad70 100644 --- a/register.php +++ b/register.php @@ -1 +1,110 @@ -get_error_message(); header("Location: " . $_SESSION["WPOA"]["LAST_URL"]); exit; } // now try to update the username to something more permanent and recognizable: $username = "user" . $user_id; $update_username_result = $wpdb->update($wpdb->users, array('user_login' => $username, 'user_nicename' => $username, 'display_name' => $username), array('ID' => $user_id)); $update_nickname_result = update_user_meta($user_id, 'nickname', $username); // apply the custom default user role: $role = get_option('wpoa_new_user_role'); $update_role_result = wp_update_user(array('ID' => $user_id, 'role' => $role)); // proceed if no errors were detected: if ($update_username_result == false || $update_nickname_result == false) { // there was an error during registration, redirect and notify the user: $_SESSION["WPOA"]["RESULT"] = "Could not rename the username during registration. Please contact an admin or try again later."; header("Location: " . $_SESSION["WPOA"]["LAST_URL"]); exit; } elseif ($update_role_result == false) { // there was an error during registration, redirect and notify the user: $_SESSION["WPOA"]["RESULT"] = "Could not assign default user role during registration. Please contact an admin or try again later."; header("Location: " . $_SESSION["WPOA"]["LAST_URL"]); exit; } else { // registration was successful, the user account was created, proceed to login the user automatically... // associate the wordpress user account with the now-authenticated third party account: $this->wpoa_link_account($user_id); // attempt to login the new user (this could be error prone): $creds = array(); $creds['user_login'] = $username; $creds['user_password'] = $password; $creds['remember'] = true; $user = wp_signon( $creds, false ); // send a notification e-mail to the admin and the new user (we can also build our own email if necessary): if (!get_option('wpoa_suppress_welcome_email')) { //wp_mail($username, "New User Registration", "Thank you for registering!\r\nYour username: " . $username . "\r\nYour password: " . $password, $headers); wp_new_user_notification( $user_id, $password ); } // finally redirect the user back to the page they were on and notify them of successful registration: $_SESSION["WPOA"]["RESULT"] = "You have been registered successfully!"; header("Location: " . $_SESSION["WPOA"]["LAST_URL"]); exit; } ?> \ No newline at end of file + 0){ + $username = $_SESSION['WPOA']['OA_USERNAME']; + } else { + $username = uniqid('', true); + } + $password = wp_generate_password(); +} + +// registration was initiated from the standard sign up form, set the username and password that was requested by the user. +if ( $_SESSION["WPOA"]["USER_ID"] == "" ) { + // this registration was initiated from the standard Registration page, create account and login the user automatically + $username = $_POST['identity']; + $password = $_POST['password']; +} + +// Try to register with the OA e-mail address if we have it +// NB: Not a security risk. This e-mail address can't be used to log in. +if(isset($_SESSION['WPOA']['OA_EMAIL']) && strlen($_SESSION['WPOA']['OA_EMAIL']) > 0){ + $email = $_SESSION['WPOA']['OA_EMAIL']; +} else { + $email = $username; // not sure why we do this, but was previous behaviour so leaving it here. +} + +// now attempt to generate the user and get the user id: +$user_id = wp_create_user( $username, $password, $email ); // we use wp_create_user instead of wp_insert_user so we can handle the error when the user being registered already exists + +// check if the user was actually created: +if (is_wp_error($user_id)) { + // there was an error during registration, redirect and notify the user: + $_SESSION["WPOA"]["RESULT"] = $user_id->get_error_message(); + header("Location: " . $_SESSION["WPOA"]["LAST_URL"]); + exit; +} + +// now try to update the username to something more permanent and recognizable: +if(isset($_SESSION['WPOA']['OA_NICENAME']) && strlen($_SESSION['WPOA']['OA_NICENAME']) > 0){ + $nicename = $_SESSION['WPOA']['OA_NICENAME']; +} else { + $nicename = $username; +} +$update_username_result = $wpdb->update($wpdb->users, array('user_login' => $username, 'user_nicename' => $nicename, 'display_name' => $nicename), array('ID' => $user_id)); +$update_nickname_result = update_user_meta($user_id, 'nickname', $nicename); + +// Update new user with other OA metadata if we have it +if(isset($_SESSION['WPOA']['GH_BIO']) && strlen($_SESSION['WPOA']['OA_DESC']) > 0){ + update_user_meta( $user_id, 'description', $_SESSION['WPOA']['OA_DESC']); +} +if(isset($_SESSION['WPOA']['OA_URL']) && strlen($_SESSION['WPOA']['OA_URL']) > 0){ + $update_username_result = $wpdb->update($wpdb->users, array('user_url' => $_SESSION['WPOA']['OA_URL']), array('ID' => $user_id)); +} + + + + +// apply the custom default user role: +$role = get_option('wpoa_new_user_role'); +$update_role_result = wp_update_user(array('ID' => $user_id, 'role' => $role)); + +// proceed if no errors were detected: +if ($update_username_result == false || $update_nickname_result == false) { + // there was an error during registration, redirect and notify the user: + $_SESSION["WPOA"]["RESULT"] = "Could not rename the username during registration. Please contact an admin or try again later."; + header("Location: " . $_SESSION["WPOA"]["LAST_URL"]); exit; +} +elseif ($update_role_result == false) { + // there was an error during registration, redirect and notify the user: + $_SESSION["WPOA"]["RESULT"] = "Could not assign default user role during registration. Please contact an admin or try again later."; + header("Location: " . $_SESSION["WPOA"]["LAST_URL"]); exit; +} +else { + // registration was successful, the user account was created, proceed to login the user automatically... + // associate the wordpress user account with the now-authenticated third party account: + $this->wpoa_link_account($user_id); + // attempt to login the new user (this could be error prone): + $creds = array(); + $creds['user_login'] = $username; + $creds['user_password'] = $password; + $creds['remember'] = true; + $user = wp_signon( $creds, false ); + // send a notification e-mail to the admin and the new user (we can also build our own email if necessary): + if (!get_option('wpoa_suppress_welcome_email')) { + //wp_mail($username, "New User Registration", "Thank you for registering!\r\nYour username: " . $username . "\r\nYour password: " . $password, $headers); + wp_new_user_notification( $user_id, $password ); + } + // finally redirect the user back to the page they were on and notify them of successful registration: + $_SESSION["WPOA"]["RESULT"] = "You have been registered successfully!"; + $this->wpoa_end_login("You have been registered successfully!"); +} +?> diff --git a/wp-oauth-settings.php b/wp-oauth-settings.php index de1c3ab..d1dde93 100644 --- a/wp-oauth-settings.php +++ b/wp-oauth-settings.php @@ -20,7 +20,7 @@ function wpoa_cc_security() { $points_max = 6; return floor(($points / $points_max) * 100); } - + // config check privacy function wpoa_cc_privacy() { $points = 0; @@ -31,7 +31,7 @@ function wpoa_cc_privacy() { $points_max = 1; return floor(($points / $points_max) * 100); } - + // config check user experience function wpoa_cc_ux() { $points = 0; @@ -44,7 +44,7 @@ function wpoa_cc_ux() { $points_max = 2; return floor(($points / $points_max) * 100); } - + // cache the config check ratings: $cc_security = wpoa_cc_security(); $cc_privacy = wpoa_cc_privacy(); @@ -75,10 +75,10 @@ function wpoa_cc_ux() {
Default Login Form / Page / Popup |
-
+
|
---|---|
Hide the WordPress login form: [?] | @@ -262,7 +262,7 @@ function wpoa_cc_ux() { |
Logo links to site: [?] | @@ -270,7 +270,7 @@ function wpoa_cc_ux() { |
Logo image: [?] | @@ -281,7 +281,7 @@ function wpoa_cc_ux() { |
Background image: [?] | @@ -292,13 +292,13 @@ function wpoa_cc_ux() { |
Custom Login Forms |
-
+
|
Custom form to show on the login screen: [?] | @@ -306,7 +306,7 @@ function wpoa_cc_ux() { |
Custom form to show on the user's profile page: [?] | @@ -314,7 +314,7 @@ function wpoa_cc_ux() { |
Custom form to show in the comments section: [?] | @@ -348,14 +348,14 @@ function wpoa_cc_ux() { |
Edit Design |
-
+
|
---|---|
Design name: [?] | @@ -363,7 +363,7 @@ function wpoa_cc_ux() { |
Icon set: [?] | @@ -374,7 +374,7 @@ function wpoa_cc_ux() { |
Show login buttons: [?] | @@ -386,7 +386,7 @@ function wpoa_cc_ux() { |
Show logout button: [?] | @@ -398,7 +398,7 @@ function wpoa_cc_ux() { |
Layout: [?] | @@ -411,7 +411,7 @@ function wpoa_cc_ux() { |
Login button prefix: [?] | @@ -419,7 +419,7 @@ function wpoa_cc_ux() { |
Logged out title: [?] | @@ -427,7 +427,7 @@ function wpoa_cc_ux() { |
Logged in title: [?] | @@ -435,7 +435,7 @@ function wpoa_cc_ux() { |
Logging in title: [?] | @@ -443,7 +443,7 @@ function wpoa_cc_ux() { |
Logging out title: [?] | @@ -451,14 +451,14 @@ function wpoa_cc_ux() { |
- + |
Instructions: @@ -653,7 +660,7 @@ function wpoa_cc_ux() {
Instructions: