Update website

lib/auth.php

@@ -0,0 +1,87 @@
+<?php
+
+require_once dirname(__FILE__)."/config/config.php";
+
+function check_auth() {
+  global $oauth_id, $oauth_secret, $oauth_callback;
+
+  if (isset($_SESSION['allowed_admin']) && $_SESSION['allowed_admin'] == true) {
+    if (isset($_GET['logout']) && $_GET['logout'] == '1') {
+      unset($_SESSION['allowed_admin']);
+    }
+    else if (isset($_SESSION['origin_url'])) {
+      header('Location: '.$_SESSION['origin_url']);
+      unset($_SESSION['origin_url']);
+      exit;
+    }
+    else return;
+  }
+
+  $provider = new Stevenmaguire\OAuth2\Client\Provider\Bitbucket([
+      'clientId'          => $oauth_id,
+      'clientSecret'      => $oauth_secret,
+      'redirectUri'       => $oauth_callback
+  ]);
+
+
+  if (!isset($_GET['code'])) {
+
+      $_SESSION['origin_url'] = $_SERVER['REQUEST_URI'];
+
+      if (isset($_GET['o'])) {
+         $_SESSION['origin_url'] = urldecode($_GET['o']);
+      }
+
+      // If we don't have an authorization code then get one
+      $authUrl = $provider->getAuthorizationUrl();
+      $_SESSION['oauth2state'] = $provider->getState();
+      header('Location: '.$authUrl);
+      exit;
+
+  // Check given state against previously stored one to mitigate CSRF attack
+  } elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
+
+      unset($_SESSION['oauth2state']);
+      exit('Invalid state');
+
+  } else {
+
+        // Try to get an access token (using the authorization code grant)
+      $token = $provider->getAccessToken('authorization_code', [
+          'code' => $_GET['code']
+      ]);
+      $_SESSION["web-key"] = $token;
+
+      // Optional: Now you have a token you can look up a users profile data
+      try {
+
+          // We got an access token, let's now get the user's details
+          $user = $provider->getResourceOwner($token);
+
+          if ($user->getUsername() != "glavaux") {
+            $_SESSION["allowed_admin"] = false;
+            exit('Invalid user');
+          }
+          $_SESSION["allowed_admin"] = true;
+
+          // Use these details to create a new profile
+  //        printf('Hello %s!', $user->getUsername());
+          if (isset($_SESSION['origin_url']) && !empty($_SESSION['origin_url'])) {
+            header('Location: '.$_SESSION['origin_url']);
+            unset($_SESSION['origin_url']);
+            exit;
+          }
+
+      } catch (Exception $e) {
+
+          // Failed to get user details
+          exit('Oh dear...');
+      }
+
+      // Use this to interact with an API on the users behalf
+  //    echo $token->getToken();
+  }
+
+}
+
+check_auth();