[Summary view]

Differences Between: [Versions 310 and 402] [Versions 311 and 402] [Versions 39 and 402]

   1  <?php
   2  
   3  // This file is part of Moodle - http://moodle.org/
   4  //
   5  // Moodle is free software: you can redistribute it and/or modify
   6  // it under the terms of the GNU General Public License as published by
   7  // the Free Software Foundation, either version 3 of the License, or
   8  // (at your option) any later version.
   9  //
  10  // Moodle is distributed in the hope that it will be useful,
  11  // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  // GNU General Public License for more details.
  14  //
  15  // You should have received a copy of the GNU General Public License
  16  // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  17  
  18  /**
  19   * An oauth2 redirection endpoint which can be used for an application:
  20   * http://tools.ietf.org/html/draft-ietf-oauth-v2-26#section-3.1.2
  21   *
  22   * This is used because some oauth servers will not allow a redirect urls
  23   * with get params (like repository callback) and that needs to be called
  24   * using the state param.
  25   *
  26   * @package    core
  27   * @copyright  2012 Dan Poltawski
  28   * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  29   */
  30  
  31  require_once(__DIR__ . '/../config.php');
  32  
  33  // The state parameter we've given (used in moodle as a redirect url).
  34  // Per https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1, state is required, even during error responses.
  35  $state = required_param('state', PARAM_LOCALURL);
  36  $redirecturl = new moodle_url($state);
  37  $params = $redirecturl->params();
  38  
  39  $error = optional_param('error', '', PARAM_RAW);
  40  
  41  if ($error) {
  42      $message = optional_param('error_description', null, PARAM_RAW);
  43  
  44      // Errors can occur for authenticated users, such as when a user denies authorization for some internal service call.
  45      // In such cases, propagate the error to the component redirect URI.
  46      if (isloggedin()) {
  47          if (isset($params['sesskey']) && confirm_sesskey($params['sesskey'])) {
  48              $redirecturl->param('error', $error);
  49              if ($message) {
  50                  $redirecturl->param('error_description', $message);
  51              }
  52              redirect($redirecturl);
  53          }
  54      }
  55  
  56      // Not logged in or the sesskey verification failed, redirect to login + show errors.
  57      $SESSION->loginerrormsg = $message ?? $error;
  58      redirect(new moodle_url(get_login_url()));
  59  }
  60  
  61  // The authorization code generated by the authorization server.
  62  $code = required_param('code', PARAM_RAW);
  63  
  64  if (isset($params['sesskey']) and confirm_sesskey($params['sesskey'])) {
  65      $redirecturl->param('oauth2code', $code);
  66      redirect($redirecturl);
  67  } else {
  68      $SESSION->loginerrormsg = get_string('invalidsesskey', 'error');
  69      redirect(new moodle_url(get_login_url()));
  70  }