aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorcash <cash.costello@gmail.com>2011-12-17 21:35:27 -0500
committercash <cash.costello@gmail.com>2011-12-17 21:35:27 -0500
commit496af3af58430afcbb3cbf7c8c6bc699e062e912 (patch)
tree71fbf197de55741439d06bca226a613ceb8b391f
parent9ce5bae1ca7a47d863cf15e6f2ba5215851f209b (diff)
downloadelgg-496af3af58430afcbb3cbf7c8c6bc699e062e912.tar.gz
elgg-496af3af58430afcbb3cbf7c8c6bc699e062e912.tar.bz2
added support for temporary storage of nonces
-rw-r--r--classes/OpenID_ElggStore.php65
-rw-r--r--lib/openid_consumer.php1
2 files changed, 59 insertions, 7 deletions
diff --git a/classes/OpenID_ElggStore.php b/classes/OpenID_ElggStore.php
index 5f6c63e42..35f4797a1 100644
--- a/classes/OpenID_ElggStore.php
+++ b/classes/OpenID_ElggStore.php
@@ -150,7 +150,7 @@ class OpenID_ElggStore extends Auth_OpenID_OpenIDStore {
/**
* Can we use this nonce?
*
- * Checks time skew and replay
+ * Checks for time skew and replay attacks
*
* @param type $server_url The identity server endpoint
* @param type $timestamp The timestamp from the nonce
@@ -164,8 +164,49 @@ class OpenID_ElggStore extends Auth_OpenID_OpenIDStore {
return false;
}
- // @todo
- // we should check if nonce has been used before to guard against replays
+ if (!$this->addNonce($server_url, $timestamp, $salt)) {
+ return false;
+ }
+
+ return true;
+ }
+
+ /**
+ * Store the nonce to prevent replay attacks
+ *
+ * @param string $server_url
+ * @param string $timestamp
+ * @param string $salt
+ * @return bool
+ */
+ protected function addNonce($server_url, $timestamp, $salt) {
+ global $Auth_OpenID_SKEW;
+
+ $identifier = md5($server_url . $timestamp . $salt);
+
+ // was the nonce already used
+ $count = elgg_get_entities_from_metadata(array(
+ 'type' => 'object',
+ 'subtype' => 'openid_client::nonce',
+ 'metadata_name' => 'identifier',
+ 'metadata_value' => $identifier,
+ 'count' => true,
+ ));
+ if ($count) {
+ return false;
+ }
+
+ // add it
+ $object = new ElggObject();
+ $object->subtype = 'openid_client::nonce';
+ $object->owner_guid = 0;
+ $object->container_guid = 0;
+ $object->access_id = ACCESS_PUBLIC;
+ $object->server_url = $server_url;
+ $object->expires = $timestamp + $Auth_OpenID_SKEW;
+ $object->identifier = $identifier;
+ $object->save();
+
return true;
}
@@ -175,12 +216,22 @@ class OpenID_ElggStore extends Auth_OpenID_OpenIDStore {
* @return int
*/
public function cleanupNonces() {
- global $Auth_OpenID_SKEW;
- $cutoff = time() - $Auth_OpenID_SKEW;
+ $options = array(
+ 'type' => 'object',
+ 'subtype' => 'openid_client::nonce',
+ 'metadata_name_value_pairs' => array(
+ array('name' => 'expires', 'value' => time(), 'operand' => '<')
+ ),
+ 'limit' => 0,
+ );
+ $nonces = elgg_get_entities_from_metadata($options);
+ $total = count($nonces);
- // @todo
+ foreach ($nonces as $nonce) {
+ $nonce->delete();
+ }
- return 0;
+ return $total;
}
/**
diff --git a/lib/openid_consumer.php b/lib/openid_consumer.php
index 3dfc09a1e..86b051c0c 100644
--- a/lib/openid_consumer.php
+++ b/lib/openid_consumer.php
@@ -12,3 +12,4 @@ require_once 'Auth/OpenID.php';
require_once 'Auth/OpenID/Consumer.php';
require_once 'Auth/OpenID/SReg.php';
require_once 'Auth/OpenID/AX.php';
+require_once 'Auth/OpenID/Interface.php';