Page MenuHomePhabricator
Files F15404126

D11724.diff
No OneTemporary
Actions

D11724.diff
View Options

diff --git a/resources/sql/autopatches/20150209.oauthclient.trust.sql b/resources/sql/autopatches/20150209.oauthclient.trust.sql
new file mode 100644
--- /dev/null
+++ b/resources/sql/autopatches/20150209.oauthclient.trust.sql
@@ -0,0 +1,2 @@
+ALTER TABLE {$NAMESPACE}_oauth_server.oauth_server_oauthserverclient
+ ADD isTrusted TINYINT(1) NOT NULL DEFAULT '0' AFTER creatorPHID;
diff --git a/src/__phutil_library_map__.php b/src/__phutil_library_map__.php
--- a/src/__phutil_library_map__.php
+++ b/src/__phutil_library_map__.php
@@ -1353,6 +1353,8 @@
'PhabricatorAuthManagementRecoverWorkflow' => 'applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php',
'PhabricatorAuthManagementRefreshWorkflow' => 'applications/auth/management/PhabricatorAuthManagementRefreshWorkflow.php',
'PhabricatorAuthManagementStripWorkflow' => 'applications/auth/management/PhabricatorAuthManagementStripWorkflow.php',
+ 'PhabricatorAuthManagementTrustOAuthClientWorkflow' => 'applications/auth/management/PhabricatorAuthManagementTrustOAuthClientWorkflow.php',
+ 'PhabricatorAuthManagementUntrustOAuthClientWorkflow' => 'applications/auth/management/PhabricatorAuthManagementUntrustOAuthClientWorkflow.php',
'PhabricatorAuthManagementWorkflow' => 'applications/auth/management/PhabricatorAuthManagementWorkflow.php',
'PhabricatorAuthNeedsApprovalController' => 'applications/auth/controller/PhabricatorAuthNeedsApprovalController.php',
'PhabricatorAuthNeedsMultiFactorController' => 'applications/auth/controller/PhabricatorAuthNeedsMultiFactorController.php',
@@ -4557,6 +4559,8 @@
'PhabricatorAuthManagementRecoverWorkflow' => 'PhabricatorAuthManagementWorkflow',
'PhabricatorAuthManagementRefreshWorkflow' => 'PhabricatorAuthManagementWorkflow',
'PhabricatorAuthManagementStripWorkflow' => 'PhabricatorAuthManagementWorkflow',
+ 'PhabricatorAuthManagementTrustOAuthClientWorkflow' => 'PhabricatorAuthManagementWorkflow',
+ 'PhabricatorAuthManagementUntrustOAuthClientWorkflow' => 'PhabricatorAuthManagementWorkflow',
'PhabricatorAuthManagementWorkflow' => 'PhabricatorManagementWorkflow',
'PhabricatorAuthNeedsApprovalController' => 'PhabricatorAuthController',
'PhabricatorAuthNeedsMultiFactorController' => 'PhabricatorAuthController',
diff --git a/src/applications/auth/management/PhabricatorAuthManagementTrustOAuthClientWorkflow.php b/src/applications/auth/management/PhabricatorAuthManagementTrustOAuthClientWorkflow.php
new file mode 100644
--- /dev/null
+++ b/src/applications/auth/management/PhabricatorAuthManagementTrustOAuthClientWorkflow.php
@@ -0,0 +1,62 @@
+<?php
+
+final class PhabricatorAuthManagementTrustOAuthClientWorkflow
+ extends PhabricatorAuthManagementWorkflow {
+
+ protected function didConstruct() {
+ $this
+ ->setName('trust-oauth-client')
+ ->setExamples('**trust-oauth-client** [--id client_id]')
+ ->setSynopsis(
+ pht(
+ 'Set Phabricator to trust an OAuth client. Phabricator '.
+ 'redirects to trusted OAuth clients that users have authorized '.
+ 'without user intervention.'))
+ ->setArguments(
+ array(
+ array(
+ 'name' => 'id',
+ 'param' => 'id',
+ 'help' => pht('The id of the OAuth client.'),
+ ),));
+ }
+
+ public function execute(PhutilArgumentParser $args) {
+ $id = $args->getArg('id');
+
+ if (!$id) {
+ throw new PhutilArgumentUsageException(
+ pht(
+ 'Specify an OAuth client id with --id.'));
+ }
+
+ $client = id(new PhabricatorOAuthServerClientQuery())
+ ->setViewer($this->getViewer())
+ ->withIDs(array($id))
+ ->executeOne();
+
+ if (!$client) {
+ throw new PhutilArgumentUsageException(
+ pht(
+ 'Failed to find an OAuth client with id %s.', $id));
+ }
+
+ if ($client->getIsTrusted()) {
+ throw new PhutilArgumentUsageException(
+ pht(
+ 'Phabricator already trusts OAuth client "%s".',
+ $client->getName()));
+ }
+
+ $client->setIsTrusted(1);
+ $client->save();
+
+ $console = PhutilConsole::getConsole();
+ $console->writeOut(
+ "%s\n",
+ pht(
+ 'Updated; Phabricator trusts OAuth client %s.',
+ $client->getName()));
+ }
+
+}
diff --git a/src/applications/auth/management/PhabricatorAuthManagementUntrustOAuthClientWorkflow.php b/src/applications/auth/management/PhabricatorAuthManagementUntrustOAuthClientWorkflow.php
new file mode 100644
--- /dev/null
+++ b/src/applications/auth/management/PhabricatorAuthManagementUntrustOAuthClientWorkflow.php
@@ -0,0 +1,62 @@
+<?php
+
+final class PhabricatorAuthManagementUntrustOAuthClientWorkflow
+ extends PhabricatorAuthManagementWorkflow {
+
+ protected function didConstruct() {
+ $this
+ ->setName('untrust-oauth-client')
+ ->setExamples('**untrust-oauth-client** [--id client_id]')
+ ->setSynopsis(
+ pht(
+ 'Set Phabricator to not trust an OAuth client. Phabricator '.
+ 'redirects to trusted OAuth clients that users have authorized '.
+ 'without user intervention.'))
+ ->setArguments(
+ array(
+ array(
+ 'name' => 'id',
+ 'param' => 'id',
+ 'help' => pht('The id of the OAuth client.'),
+ ),));
+ }
+
+ public function execute(PhutilArgumentParser $args) {
+ $id = $args->getArg('id');
+
+ if (!$id) {
+ throw new PhutilArgumentUsageException(
+ pht(
+ 'Specify an OAuth client id with --id.'));
+ }
+
+ $client = id(new PhabricatorOAuthServerClientQuery())
+ ->setViewer($this->getViewer())
+ ->withIDs(array($id))
+ ->executeOne();
+
+ if (!$client) {
+ throw new PhutilArgumentUsageException(
+ pht(
+ 'Failed to find an OAuth client with id %s.', $id));
+ }
+
+ if (!$client->getIsTrusted()) {
+ throw new PhutilArgumentUsageException(
+ pht(
+ 'Phabricator already does not trust OAuth client "%s".',
+ $client->getName()));
+ }
+
+ $client->setIsTrusted(0);
+ $client->save();
+
+ $console = PhutilConsole::getConsole();
+ $console->writeOut(
+ "%s\n",
+ pht(
+ 'Updated; Phabricator does not trust OAuth client %s.',
+ $client->getName()));
+ }
+
+}
diff --git a/src/applications/oauthserver/controller/PhabricatorOAuthServerAuthController.php b/src/applications/oauthserver/controller/PhabricatorOAuthServerAuthController.php
--- a/src/applications/oauthserver/controller/PhabricatorOAuthServerAuthController.php
+++ b/src/applications/oauthserver/controller/PhabricatorOAuthServerAuthController.php
@@ -182,6 +182,12 @@
'state' => $state,
));
+ if ($client->getIsTrusted()) {
+ return id(new AphrontRedirectResponse())
+ ->setIsExternal(true)
+ ->setURI((string)$full_uri);
+ }
+
// TODO: It would be nice to give the user more options here, like
// reviewing permissions, canceling the authorization, or aborting
// the workflow.
diff --git a/src/applications/oauthserver/storage/PhabricatorOAuthServerClient.php b/src/applications/oauthserver/storage/PhabricatorOAuthServerClient.php
--- a/src/applications/oauthserver/storage/PhabricatorOAuthServerClient.php
+++ b/src/applications/oauthserver/storage/PhabricatorOAuthServerClient.php
@@ -10,6 +10,7 @@
protected $name;
protected $redirectURI;
protected $creatorPHID;
+ protected $isTrusted = 0;
protected $viewPolicy;
protected $editPolicy;
@@ -40,6 +41,7 @@
'name' => 'text255',
'secret' => 'text32',
'redirectURI' => 'text255',
+ 'isTrusted' => 'bool',
),
self::CONFIG_KEY_SCHEMA => array(
'key_phid' => null,

File Metadata

Mime Type
text/plain
Expires
Mar 19 2025, 6:20 AM (5 w, 16 h ago)
Storage Engine
blob
Storage Format
Encrypted (AES-256-CBC)
Storage Handle
7693452
Default Alt Text
D11724.diff (7 KB)

Event Timeline

Phabricator · Built by Phacility