New file |
0,0 → 1,674 |
<?php |
|
/** |
* This file supplies a Memcached store backend for OpenID servers and |
* consumers. |
* |
* PHP versions 4 and 5 |
* |
* LICENSE: See the COPYING file included in this distribution. |
* |
* @package OpenID |
* @author JanRain, Inc. <openid@janrain.com> |
* @copyright 2005 Janrain, Inc. |
* @license http://www.gnu.org/copyleft/lesser.html LGPL |
* |
*/ |
|
/** |
* Require base class for creating a new interface. |
*/ |
require_once 'Auth/OpenID.php'; |
require_once 'Auth/OpenID/Interface.php'; |
require_once 'Auth/OpenID/HMACSHA1.php'; |
|
/** |
* This is a filesystem-based store for OpenID associations and |
* nonces. This store should be safe for use in concurrent systems on |
* both windows and unix (excluding NFS filesystems). There are a |
* couple race conditions in the system, but those failure cases have |
* been set up in such a way that the worst-case behavior is someone |
* having to try to log in a second time. |
* |
* Most of the methods of this class are implementation details. |
* People wishing to just use this store need only pay attention to |
* the constructor. |
* |
* @package OpenID |
*/ |
class Auth_OpenID_FileStore extends Auth_OpenID_OpenIDStore { |
|
/** |
* Initializes a new {@link Auth_OpenID_FileStore}. This |
* initializes the nonce and association directories, which are |
* subdirectories of the directory passed in. |
* |
* @param string $directory This is the directory to put the store |
* directories in. |
*/ |
function Auth_OpenID_FileStore($directory) |
{ |
if (!Auth_OpenID::ensureDir($directory)) { |
trigger_error('Not a directory and failed to create: ' |
. $directory, E_USER_ERROR); |
} |
$directory = realpath($directory); |
|
$this->directory = $directory; |
$this->active = true; |
|
$this->nonce_dir = $directory . DIRECTORY_SEPARATOR . 'nonces'; |
|
$this->association_dir = $directory . DIRECTORY_SEPARATOR . |
'associations'; |
|
// Temp dir must be on the same filesystem as the assciations |
// $directory and the $directory containing the auth key file. |
$this->temp_dir = $directory . DIRECTORY_SEPARATOR . 'temp'; |
|
$this->auth_key_name = $directory . DIRECTORY_SEPARATOR . 'auth_key'; |
|
$this->max_nonce_age = 6 * 60 * 60; // Six hours, in seconds |
|
if (!$this->_setup()) { |
trigger_error('Failed to initialize OpenID file store in ' . |
$directory, E_USER_ERROR); |
} |
} |
|
function destroy() |
{ |
Auth_OpenID_FileStore::_rmtree($this->directory); |
$this->active = false; |
} |
|
/** |
* Make sure that the directories in which we store our data |
* exist. |
* |
* @access private |
*/ |
function _setup() |
{ |
return (Auth_OpenID::ensureDir(dirname($this->auth_key_name)) && |
Auth_OpenID::ensureDir($this->nonce_dir) && |
Auth_OpenID::ensureDir($this->association_dir) && |
Auth_OpenID::ensureDir($this->temp_dir)); |
} |
|
/** |
* Create a temporary file on the same filesystem as |
* $this->auth_key_name and $this->association_dir. |
* |
* The temporary directory should not be cleaned if there are any |
* processes using the store. If there is no active process using |
* the store, it is safe to remove all of the files in the |
* temporary directory. |
* |
* @return array ($fd, $filename) |
* @access private |
*/ |
function _mktemp() |
{ |
$name = Auth_OpenID_FileStore::_mkstemp($dir = $this->temp_dir); |
$file_obj = @fopen($name, 'wb'); |
if ($file_obj !== false) { |
return array($file_obj, $name); |
} else { |
Auth_OpenID_FileStore::_removeIfPresent($name); |
} |
} |
|
/** |
* Read the auth key from the auth key file. Will return None if |
* there is currently no key. |
* |
* @return mixed |
*/ |
function readAuthKey() |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$auth_key_file = @fopen($this->auth_key_name, 'rb'); |
if ($auth_key_file === false) { |
return null; |
} |
|
$key = fread($auth_key_file, filesize($this->auth_key_name)); |
fclose($auth_key_file); |
|
return $key; |
} |
|
/** |
* Generate a new random auth key and safely store it in the |
* location specified by $this->auth_key_name. |
* |
* @return string $key |
*/ |
function createAuthKey() |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$auth_key = Auth_OpenID_CryptUtil::randomString($this->AUTH_KEY_LEN); |
|
list($file_obj, $tmp) = $this->_mktemp(); |
|
fwrite($file_obj, $auth_key); |
fflush($file_obj); |
fclose($file_obj); |
|
if (function_exists('link')) { |
// Posix filesystem |
$saved = link($tmp, $this->auth_key_name); |
Auth_OpenID_FileStore::_removeIfPresent($tmp); |
} else { |
// Windows filesystem |
$saved = rename($tmp, $this->auth_key_name); |
} |
|
if (!$saved) { |
// The link failed, either because we lack the permission, |
// or because the file already exists; try to read the key |
// in case the file already existed. |
$auth_key = $this->readAuthKey(); |
} |
|
return $auth_key; |
} |
|
/** |
* Retrieve the auth key from the file specified by |
* $this->auth_key_name, creating it if it does not exist. |
* |
* @return string $key |
*/ |
function getAuthKey() |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$auth_key = $this->readAuthKey(); |
if ($auth_key === null) { |
$auth_key = $this->createAuthKey(); |
|
if (strlen($auth_key) != $this->AUTH_KEY_LEN) { |
$fmt = 'Got an invalid auth key from %s. Expected '. |
'%d-byte string. Got: %s'; |
$msg = sprintf($fmt, $this->auth_key_name, $this->AUTH_KEY_LEN, |
$auth_key); |
trigger_error($msg, E_USER_WARNING); |
return null; |
} |
} |
return $auth_key; |
} |
|
/** |
* Create a unique filename for a given server url and |
* handle. This implementation does not assume anything about the |
* format of the handle. The filename that is returned will |
* contain the domain name from the server URL for ease of human |
* inspection of the data directory. |
* |
* @return string $filename |
*/ |
function getAssociationFilename($server_url, $handle) |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
if (strpos($server_url, '://') === false) { |
trigger_error(sprintf("Bad server URL: %s", $server_url), |
E_USER_WARNING); |
return null; |
} |
|
list($proto, $rest) = explode('://', $server_url, 2); |
$parts = explode('/', $rest); |
$domain = Auth_OpenID_FileStore::_filenameEscape($parts[0]); |
$url_hash = Auth_OpenID_FileStore::_safe64($server_url); |
if ($handle) { |
$handle_hash = Auth_OpenID_FileStore::_safe64($handle); |
} else { |
$handle_hash = ''; |
} |
|
$filename = sprintf('%s-%s-%s-%s', $proto, $domain, $url_hash, |
$handle_hash); |
|
return $this->association_dir. DIRECTORY_SEPARATOR . $filename; |
} |
|
/** |
* Store an association in the association directory. |
*/ |
function storeAssociation($server_url, $association) |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return false; |
} |
|
$association_s = $association->serialize(); |
$filename = $this->getAssociationFilename($server_url, |
$association->handle); |
list($tmp_file, $tmp) = $this->_mktemp(); |
|
if (!$tmp_file) { |
trigger_error("_mktemp didn't return a valid file descriptor", |
E_USER_WARNING); |
return false; |
} |
|
fwrite($tmp_file, $association_s); |
|
fflush($tmp_file); |
|
fclose($tmp_file); |
|
if (@rename($tmp, $filename)) { |
return true; |
} else { |
// In case we are running on Windows, try unlinking the |
// file in case it exists. |
@unlink($filename); |
|
// Now the target should not exist. Try renaming again, |
// giving up if it fails. |
if (@rename($tmp, $filename)) { |
return true; |
} |
} |
|
// If there was an error, don't leave the temporary file |
// around. |
Auth_OpenID_FileStore::_removeIfPresent($tmp); |
return false; |
} |
|
/** |
* Retrieve an association. If no handle is specified, return the |
* association with the most recent issue time. |
* |
* @return mixed $association |
*/ |
function getAssociation($server_url, $handle = null) |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
if ($handle === null) { |
$handle = ''; |
} |
|
// The filename with the empty handle is a prefix of all other |
// associations for the given server URL. |
$filename = $this->getAssociationFilename($server_url, $handle); |
|
if ($handle) { |
return $this->_getAssociation($filename); |
} else { |
$association_files = |
Auth_OpenID_FileStore::_listdir($this->association_dir); |
$matching_files = array(); |
|
// strip off the path to do the comparison |
$name = basename($filename); |
foreach ($association_files as $association_file) { |
if (strpos($association_file, $name) === 0) { |
$matching_files[] = $association_file; |
} |
} |
|
$matching_associations = array(); |
// read the matching files and sort by time issued |
foreach ($matching_files as $name) { |
$full_name = $this->association_dir . DIRECTORY_SEPARATOR . |
$name; |
$association = $this->_getAssociation($full_name); |
if ($association !== null) { |
$matching_associations[] = array($association->issued, |
$association); |
} |
} |
|
$issued = array(); |
$assocs = array(); |
foreach ($matching_associations as $key => $assoc) { |
$issued[$key] = $assoc[0]; |
$assocs[$key] = $assoc[1]; |
} |
|
array_multisort($issued, SORT_DESC, $assocs, SORT_DESC, |
$matching_associations); |
|
// return the most recently issued one. |
if ($matching_associations) { |
list($issued, $assoc) = $matching_associations[0]; |
return $assoc; |
} else { |
return null; |
} |
} |
} |
|
/** |
* @access private |
*/ |
function _getAssociation($filename) |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$assoc_file = @fopen($filename, 'rb'); |
|
if ($assoc_file === false) { |
return null; |
} |
|
$assoc_s = fread($assoc_file, filesize($filename)); |
fclose($assoc_file); |
|
if (!$assoc_s) { |
return null; |
} |
|
$association = |
Auth_OpenID_Association::deserialize('Auth_OpenID_Association', |
$assoc_s); |
|
if (!$association) { |
Auth_OpenID_FileStore::_removeIfPresent($filename); |
return null; |
} |
|
if ($association->getExpiresIn() == 0) { |
Auth_OpenID_FileStore::_removeIfPresent($filename); |
return null; |
} else { |
return $association; |
} |
} |
|
/** |
* Remove an association if it exists. Do nothing if it does not. |
* |
* @return bool $success |
*/ |
function removeAssociation($server_url, $handle) |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$assoc = $this->getAssociation($server_url, $handle); |
if ($assoc === null) { |
return false; |
} else { |
$filename = $this->getAssociationFilename($server_url, $handle); |
return Auth_OpenID_FileStore::_removeIfPresent($filename); |
} |
} |
|
/** |
* Mark this nonce as present. |
*/ |
function storeNonce($nonce) |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$filename = $this->nonce_dir . DIRECTORY_SEPARATOR . $nonce; |
$nonce_file = fopen($filename, 'w'); |
if ($nonce_file === false) { |
return false; |
} |
fclose($nonce_file); |
return true; |
} |
|
/** |
* Return whether this nonce is present. As a side effect, mark it |
* as no longer present. |
* |
* @return bool $present |
*/ |
function useNonce($nonce) |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$filename = $this->nonce_dir . DIRECTORY_SEPARATOR . $nonce; |
$st = @stat($filename); |
|
if ($st === false) { |
return false; |
} |
|
// Either it is too old or we are using it. Either way, we |
// must remove the file. |
if (!unlink($filename)) { |
return false; |
} |
|
$now = time(); |
$nonce_age = $now - $st[9]; |
|
// We can us it if the age of the file is less than the |
// expiration time. |
return $nonce_age <= $this->max_nonce_age; |
} |
|
/** |
* Remove expired entries from the database. This is potentially |
* expensive, so only run when it is acceptable to take time. |
*/ |
function clean() |
{ |
if (!$this->active) { |
trigger_error("FileStore no longer active", E_USER_ERROR); |
return null; |
} |
|
$nonces = Auth_OpenID_FileStore::_listdir($this->nonce_dir); |
$now = time(); |
|
// Check all nonces for expiry |
foreach ($nonces as $nonce) { |
$filename = $this->nonce_dir . DIRECTORY_SEPARATOR . $nonce; |
$st = @stat($filename); |
|
if ($st !== false) { |
// Remove the nonce if it has expired |
$nonce_age = $now - $st[9]; |
if ($nonce_age > $this->max_nonce_age) { |
Auth_OpenID_FileStore::_removeIfPresent($filename); |
} |
} |
} |
|
$association_filenames = |
Auth_OpenID_FileStore::_listdir($this->association_dir); |
|
foreach ($association_filenames as $association_filename) { |
$association_file = fopen($association_filename, 'rb'); |
|
if ($association_file !== false) { |
$assoc_s = fread($association_file, |
filesize($association_filename)); |
fclose($association_file); |
|
// Remove expired or corrupted associations |
$association = |
Auth_OpenID_Association::deserialize( |
'Auth_OpenID_Association', $assoc_s); |
|
if ($association === null) { |
Auth_OpenID_FileStore::_removeIfPresent( |
$association_filename); |
} else { |
if ($association->getExpiresIn() == 0) { |
Auth_OpenID_FileStore::_removeIfPresent( |
$association_filename); |
} |
} |
} |
} |
} |
|
/** |
* @access private |
*/ |
function _rmtree($dir) |
{ |
if ($dir[strlen($dir) - 1] != DIRECTORY_SEPARATOR) { |
$dir .= DIRECTORY_SEPARATOR; |
} |
|
if ($handle = opendir($dir)) { |
while ($item = readdir($handle)) { |
if (!in_array($item, array('.', '..'))) { |
if (is_dir($dir . $item)) { |
|
if (!Auth_OpenID_FileStore::_rmtree($dir . $item)) { |
return false; |
} |
} else if (is_file($dir . $item)) { |
if (!unlink($dir . $item)) { |
return false; |
} |
} |
} |
} |
|
closedir($handle); |
|
if (!@rmdir($dir)) { |
return false; |
} |
|
return true; |
} else { |
// Couldn't open directory. |
return false; |
} |
} |
|
/** |
* @access private |
*/ |
function _mkstemp($dir) |
{ |
foreach (range(0, 4) as $i) { |
$name = tempnam($dir, "php_openid_filestore_"); |
|
if ($name !== false) { |
return $name; |
} |
} |
return false; |
} |
|
/** |
* @access private |
*/ |
function _mkdtemp($dir) |
{ |
foreach (range(0, 4) as $i) { |
$name = $dir . strval(DIRECTORY_SEPARATOR) . strval(getmypid()) . |
"-" . strval(rand(1, time())); |
if (!mkdir($name, 0700)) { |
return false; |
} else { |
return $name; |
} |
} |
return false; |
} |
|
/** |
* @access private |
*/ |
function _listdir($dir) |
{ |
$handle = opendir($dir); |
$files = array(); |
while (false !== ($filename = readdir($handle))) { |
$files[] = $filename; |
} |
return $files; |
} |
|
/** |
* @access private |
*/ |
function _isFilenameSafe($char) |
{ |
$_Auth_OpenID_filename_allowed = Auth_OpenID_letters . |
Auth_OpenID_digits . "."; |
return (strpos($_Auth_OpenID_filename_allowed, $char) !== false); |
} |
|
/** |
* @access private |
*/ |
function _safe64($str) |
{ |
$h64 = base64_encode(Auth_OpenID_SHA1($str)); |
$h64 = str_replace('+', '_', $h64); |
$h64 = str_replace('/', '.', $h64); |
$h64 = str_replace('=', '', $h64); |
return $h64; |
} |
|
/** |
* @access private |
*/ |
function _filenameEscape($str) |
{ |
$filename = ""; |
for ($i = 0; $i < strlen($str); $i++) { |
$c = $str[$i]; |
if (Auth_OpenID_FileStore::_isFilenameSafe($c)) { |
$filename .= $c; |
} else { |
$filename .= sprintf("_%02X", ord($c)); |
} |
} |
return $filename; |
} |
|
/** |
* Attempt to remove a file, returning whether the file existed at |
* the time of the call. |
* |
* @access private |
* @return bool $result True if the file was present, false if not. |
*/ |
function _removeIfPresent($filename) |
{ |
return @unlink($filename); |
} |
} |
|
?> |