From 7fbb51adb9b85ef4b3f53fbb3f9e9c5ee8d0b4ef Mon Sep 17 00:00:00 2001 From: root Date: Tue, 24 May 2016 22:36:51 +0200 Subject: [PATCH 1/4] Do not normalize openid url when logging in (since it isn't normalized when setting it via user settings) NOTE: this broke with 8367cad --- mod/openid.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mod/openid.php b/mod/openid.php index 5d5539f00..bccfcd95c 100644 --- a/mod/openid.php +++ b/mod/openid.php @@ -18,7 +18,8 @@ function openid_content(&$a) { if($openid->validate()) { - $authid = normalise_openid($_REQUEST['openid_identity']); + #$authid = normalise_openid($_REQUEST['openid_identity']); + $authid = $_REQUEST['openid_identity']; if(! strlen($authid)) { logger( t('OpenID protocol error. No ID returned.') . EOL); From 3c402b6a6ce9562f38b5a1714d6c5beb1cf0a220 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 24 May 2016 22:37:40 +0200 Subject: [PATCH 2/4] Remove debug log --- library/openid.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/openid.php b/library/openid.php index 3c58beb8a..7e5873bdb 100644 --- a/library/openid.php +++ b/library/openid.php @@ -375,7 +375,7 @@ class LightOpenID $server = $server[1]; if (isset($delegate[2])) $this->identity = trim($delegate[2]); $this->version = 2; -logger('Server: ' . $server); +#logger('Server: ' . $server); $this->server = $server; return $server; } From b7bc428630919355e5ed5d813120990640f78890 Mon Sep 17 00:00:00 2001 From: Sandro Santilli Date: Wed, 25 May 2016 12:43:26 +0200 Subject: [PATCH 3/4] Fix OpenID login The problem was that while openid was stored not-normalized in the database, the checking code was looking for a normalized form instead. The commit removing normalization step on saving user preferences was 8367cad, which might have left old users with normalized openid and new users with non-normalized one. This commit makes the checking code look for both normalized and not normalized form, to be backward compatible. --- mod/openid.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mod/openid.php b/mod/openid.php index bccfcd95c..893db8030 100644 --- a/mod/openid.php +++ b/mod/openid.php @@ -26,10 +26,15 @@ function openid_content(&$a) { goaway(z_root()); } + // NOTE: we search both for normalised and non-normalised form of $authid + // because the normalization step was removed from setting + // mod/settings.php in 8367cad so it might have left mixed + // records in the user table + // $r = q("SELECT `user`.*, `user`.`pubkey` as `upubkey`, `user`.`prvkey` as `uprvkey` - FROM `user` WHERE `openid` = '%s' AND `blocked` = 0 + FROM `user` WHERE ( openid = '%s' OR openid = '%s' ) AND blocked = 0 AND `account_expired` = 0 AND `account_removed` = 0 AND `verified` = 1 LIMIT 1", - dbesc($authid) + dbesc($authid), dbesc(normalise_openid($authid)) ); if($r && count($r)) { From 10e6a243ea973a9db7db35daecad33be61c4a725 Mon Sep 17 00:00:00 2001 From: Sandro Santilli Date: Wed, 25 May 2016 16:06:16 +0200 Subject: [PATCH 4/4] Simplify openid query, and (needlessly) quote all fields Fields quoting was requested by rabuzarus --- mod/openid.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/mod/openid.php b/mod/openid.php index 893db8030..0ebda485d 100644 --- a/mod/openid.php +++ b/mod/openid.php @@ -18,7 +18,6 @@ function openid_content(&$a) { if($openid->validate()) { - #$authid = normalise_openid($_REQUEST['openid_identity']); $authid = $_REQUEST['openid_identity']; if(! strlen($authid)) { @@ -31,9 +30,11 @@ function openid_content(&$a) { // mod/settings.php in 8367cad so it might have left mixed // records in the user table // - $r = q("SELECT `user`.*, `user`.`pubkey` as `upubkey`, `user`.`prvkey` as `uprvkey` - FROM `user` WHERE ( openid = '%s' OR openid = '%s' ) AND blocked = 0 - AND `account_expired` = 0 AND `account_removed` = 0 AND `verified` = 1 LIMIT 1", + $r = q("SELECT * FROM `user` + WHERE ( `openid` = '%s' OR `openid` = '%s' ) + AND `blocked` = 0 AND `account_expired` = 0 + AND `account_removed` = 0 AND `verified` = 1 + LIMIT 1", dbesc($authid), dbesc(normalise_openid($authid)) );