No OneTemporary
Actions

Size

48 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/applications/auth/application/PhabricatorAuthApplication.php b/src/applications/auth/application/PhabricatorAuthApplication.php
	index 0b3487b71b..52cf01b2aa 100644
	--- a/src/applications/auth/application/PhabricatorAuthApplication.php
	+++ b/src/applications/auth/application/PhabricatorAuthApplication.php
	@@ -1,154 +1,154 @@
	<?php

	final class PhabricatorAuthApplication extends PhabricatorApplication {

	public function canUninstall() {
	return false;
	}

	public function getBaseURI() {
	return '/auth/';
	}

	public function getIcon() {
	return 'fa-key';
	}

	public function isPinnedByDefault(PhabricatorUser $viewer) {
	return $viewer->getIsAdmin();
	}

	public function getName() {
	return pht('Auth');
	}

	public function getShortDescription() {
	return pht('Login/Registration');
	}

	public function getHelpDocumentationArticles(PhabricatorUser $viewer) {
	// NOTE: Although reasonable help exists for this in "Configuring Accounts
	// and Registration", specifying help items here means we get the menu
	// item in all the login/link interfaces, which is confusing and not
	// helpful.

	// TODO: Special case this, or split the auth and auth administration
	// applications?

	return array();
	}

	public function getApplicationGroup() {
	return self::GROUP_ADMIN;
	}

	public function getRoutes() {
	return array(
	'/auth/' => array(
	'' => 'PhabricatorAuthListController',
	'config/' => array(
	'new/' => 'PhabricatorAuthNewController',
	'edit/(?:(?P<id>\d+)/)?' => 'PhabricatorAuthEditController',
	'(?P<action>enable\|disable)/(?P<id>\d+)/'
	=> 'PhabricatorAuthDisableController',
	'view/(?P<id>\d+)/' => 'PhabricatorAuthProviderViewController',
	),
	'login/(?P<pkey>[^/]+)/(?:(?P<extra>[^/]+)/)?'
	=> 'PhabricatorAuthLoginController',
	'(?P<loggedout>loggedout)/' => 'PhabricatorAuthStartController',
	'invite/(?P<code>[^/]+)/' => 'PhabricatorAuthInviteController',
	'register/(?:(?P<akey>[^/]+)/)?' => 'PhabricatorAuthRegisterController',
	'start/' => 'PhabricatorAuthStartController',
	'validate/' => 'PhabricatorAuthValidateController',
	'finish/' => 'PhabricatorAuthFinishController',
	'unlink/(?P<id>\d+)/' => 'PhabricatorAuthUnlinkController',
	- '(?P<action>link\|refresh)/(?P<pkey>[^/]+)/'
	+ '(?P<action>link\|refresh)/(?P<id>\d+)/'
	=> 'PhabricatorAuthLinkController',
	'confirmlink/(?P<akey>[^/]+)/'
	=> 'PhabricatorAuthConfirmLinkController',
	'session/terminate/(?P<id>[^/]+)/'
	=> 'PhabricatorAuthTerminateSessionController',
	'token/revoke/(?P<id>[^/]+)/'
	=> 'PhabricatorAuthRevokeTokenController',
	'session/downgrade/'
	=> 'PhabricatorAuthDowngradeSessionController',
	'enroll/' => array(
	'(?:(?P<pageKey>[^/]+)/)?(?:(?P<formSaved>saved)/)?'
	=> 'PhabricatorAuthNeedsMultiFactorController',
	),
	'sshkey/' => array(
	$this->getQueryRoutePattern('for/(?P<forPHID>[^/]+)/')
	=> 'PhabricatorAuthSSHKeyListController',
	'generate/' => 'PhabricatorAuthSSHKeyGenerateController',
	'upload/' => 'PhabricatorAuthSSHKeyEditController',
	'edit/(?P<id>\d+)/' => 'PhabricatorAuthSSHKeyEditController',
	'revoke/(?P<id>\d+)/'
	=> 'PhabricatorAuthSSHKeyRevokeController',
	'view/(?P<id>\d+)/' => 'PhabricatorAuthSSHKeyViewController',
	),
	'password/' => 'PhabricatorAuthSetPasswordController',

	'mfa/' => array(
	$this->getQueryRoutePattern() =>
	'PhabricatorAuthFactorProviderListController',
	$this->getEditRoutePattern('edit/') =>
	'PhabricatorAuthFactorProviderEditController',
	'(?P<id>[1-9]\d*)/' =>
	'PhabricatorAuthFactorProviderViewController',
	'message/(?P<id>[1-9]\d*)/' =>
	'PhabricatorAuthFactorProviderMessageController',
	),

	'message/' => array(
	$this->getQueryRoutePattern() =>
	'PhabricatorAuthMessageListController',
	$this->getEditRoutePattern('edit/') =>
	'PhabricatorAuthMessageEditController',
	'(?P<id>[1-9]\d*)/' =>
	'PhabricatorAuthMessageViewController',
	),

	'contact/' => array(
	$this->getEditRoutePattern('edit/') =>
	'PhabricatorAuthContactNumberEditController',
	'(?P<id>[1-9]\d*)/' =>
	'PhabricatorAuthContactNumberViewController',
	'(?P<action>disable\|enable)/(?P<id>[1-9]\d*)/' =>
	'PhabricatorAuthContactNumberDisableController',
	'primary/(?P<id>[1-9]\d*)/' =>
	'PhabricatorAuthContactNumberPrimaryController',
	'test/(?P<id>[1-9]\d*)/' =>
	'PhabricatorAuthContactNumberTestController',
	),
	),

	'/oauth/(?P<provider>\w+)/login/'
	=> 'PhabricatorAuthOldOAuthRedirectController',

	'/login/' => array(
	'' => 'PhabricatorAuthStartController',
	'email/' => 'PhabricatorEmailLoginController',
	'once/'.
	'(?P<type>[^/]+)/'.
	'(?P<id>\d+)/'.
	'(?P<key>[^/]+)/'.
	'(?:(?P<emailID>\d+)/)?' => 'PhabricatorAuthOneTimeLoginController',
	'refresh/' => 'PhabricatorRefreshCSRFController',
	'mustverify/' => 'PhabricatorMustVerifyEmailController',
	),

	'/emailverify/(?P<code>[^/]+)/'
	=> 'PhabricatorEmailVerificationController',

	'/logout/' => 'PhabricatorLogoutController',
	);
	}

	protected function getCustomCapabilities() {
	return array(
	AuthManageProvidersCapability::CAPABILITY => array(
	'default' => PhabricatorPolicies::POLICY_ADMIN,
	),
	);
	}
	}
	diff --git a/src/applications/auth/controller/PhabricatorAuthConfirmLinkController.php b/src/applications/auth/controller/PhabricatorAuthConfirmLinkController.php
	index 664a97885f..9ceb10df8b 100644
	--- a/src/applications/auth/controller/PhabricatorAuthConfirmLinkController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthConfirmLinkController.php
	@@ -1,78 +1,79 @@
	<?php

	final class PhabricatorAuthConfirmLinkController
	extends PhabricatorAuthController {

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$accountkey = $request->getURIData('akey');

	$result = $this->loadAccountForRegistrationOrLinking($accountkey);
	list($account, $provider, $response) = $result;

	if ($response) {
	return $response;
	}

	if (!$provider->shouldAllowAccountLink()) {
	return $this->renderError(pht('This account is not linkable.'));
	}

	$panel_uri = '/settings/panel/external/';

	- if ($request->isFormPost()) {
	+ if ($request->isFormOrHisecPost()) {
	+ $workflow_key = sprintf(
	+ 'account.link(%s)',
	+ $account->getPHID());
	+
	+ $hisec_token = id(new PhabricatorAuthSessionEngine())
	+ ->setWorkflowKey($workflow_key)
	+ ->requireHighSecurityToken($viewer, $request, $panel_uri);
	+
	$account->setUserPHID($viewer->getPHID());
	$account->save();

	$this->clearRegistrationCookies();

	// TODO: Send the user email about the new account link.

	return id(new AphrontRedirectResponse())->setURI($panel_uri);
	}

	- // TODO: Provide more information about the external account. Clicking
	- // through this form blindly is dangerous.
	-
	- // TODO: If the user has password authentication, require them to retype
	- // their password here.
	-
	- $dialog = id(new AphrontDialogView())
	- ->setUser($viewer)
	+ $dialog = $this->newDialog()
	->setTitle(pht('Confirm %s Account Link', $provider->getProviderName()))
	->addCancelButton($panel_uri)
	->addSubmitButton(pht('Confirm Account Link'));

	$form = id(new PHUIFormLayoutView())
	->setFullWidth(true)
	->appendChild(
	phutil_tag(
	'div',
	array(
	'class' => 'aphront-form-instructions',
	),
	pht(
	'Confirm the link with this %s account. This account will be '.
	'able to log in to your Phabricator account.',
	$provider->getProviderName())))
	->appendChild(
	id(new PhabricatorAuthAccountView())
	->setUser($viewer)
	->setExternalAccount($account)
	->setAuthProvider($provider));

	$dialog->appendChild($form);

	$crumbs = $this->buildApplicationCrumbs();
	$crumbs->addTextCrumb(pht('Confirm Link'), $panel_uri);
	$crumbs->addTextCrumb($provider->getProviderName());
	$crumbs->setBorder(true);

	return $this->newPage()
	->setTitle(pht('Confirm External Account Link'))
	->setCrumbs($crumbs)
	->appendChild($dialog);
	}


	}
	diff --git a/src/applications/auth/controller/PhabricatorAuthController.php b/src/applications/auth/controller/PhabricatorAuthController.php
	index 9b7267ec96..e81301218c 100644
	--- a/src/applications/auth/controller/PhabricatorAuthController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthController.php
	@@ -1,289 +1,289 @@
	<?php

	abstract class PhabricatorAuthController extends PhabricatorController {

	protected function renderErrorPage($title, array $messages) {
	$view = new PHUIInfoView();
	$view->setTitle($title);
	$view->setErrors($messages);

	return $this->newPage()
	->setTitle($title)
	->appendChild($view);

	}

	/**
	* Returns true if this install is newly setup (i.e., there are no user
	* accounts yet). In this case, we enter a special mode to permit creation
	* of the first account form the web UI.
	*/
	protected function isFirstTimeSetup() {
	// If there are any auth providers, this isn't first time setup, even if
	// we don't have accounts.
	if (PhabricatorAuthProvider::getAllEnabledProviders()) {
	return false;
	}

	// Otherwise, check if there are any user accounts. If not, we're in first
	// time setup.
	$any_users = id(new PhabricatorPeopleQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->setLimit(1)
	->execute();

	return !$any_users;
	}


	/**
	* Log a user into a web session and return an @{class:AphrontResponse} which
	* corresponds to continuing the login process.
	*
	* Normally, this is a redirect to the validation controller which makes sure
	* the user's cookies are set. However, event listeners can intercept this
	* event and do something else if they prefer.
	*
	* @param PhabricatorUser User to log the viewer in as.
	* @param bool True to issue a full session immediately, bypassing MFA.
	* @return AphrontResponse Response which continues the login process.
	*/
	protected function loginUser(
	PhabricatorUser $user,
	$force_full_session = false) {

	$response = $this->buildLoginValidateResponse($user);
	$session_type = PhabricatorAuthSession::TYPE_WEB;

	if ($force_full_session) {
	$partial_session = false;
	} else {
	$partial_session = true;
	}

	$session_key = id(new PhabricatorAuthSessionEngine())
	->establishSession($session_type, $user->getPHID(), $partial_session);

	// NOTE: We allow disabled users to login and roadblock them later, so
	// there's no check for users being disabled here.

	$request = $this->getRequest();
	$request->setCookie(
	PhabricatorCookies::COOKIE_USERNAME,
	$user->getUsername());
	$request->setCookie(
	PhabricatorCookies::COOKIE_SESSION,
	$session_key);

	$this->clearRegistrationCookies();

	return $response;
	}

	protected function clearRegistrationCookies() {
	$request = $this->getRequest();

	// Clear the registration key.
	$request->clearCookie(PhabricatorCookies::COOKIE_REGISTRATION);

	// Clear the client ID / OAuth state key.
	$request->clearCookie(PhabricatorCookies::COOKIE_CLIENTID);

	// Clear the invite cookie.
	$request->clearCookie(PhabricatorCookies::COOKIE_INVITE);
	}

	private function buildLoginValidateResponse(PhabricatorUser $user) {
	$validate_uri = new PhutilURI($this->getApplicationURI('validate/'));
	$validate_uri->setQueryParam('expect', $user->getUsername());

	return id(new AphrontRedirectResponse())->setURI((string)$validate_uri);
	}

	protected function renderError($message) {
	return $this->renderErrorPage(
	pht('Authentication Error'),
	array(
	$message,
	));
	}

	protected function loadAccountForRegistrationOrLinking($account_key) {
	$request = $this->getRequest();
	$viewer = $request->getUser();

	$account = null;
	$provider = null;
	$response = null;

	if (!$account_key) {
	$response = $this->renderError(
	pht('Request did not include account key.'));
	return array($account, $provider, $response);
	}

	// NOTE: We're using the omnipotent user because the actual user may not
	// be logged in yet, and because we want to tailor an error message to
	// distinguish between "not usable" and "does not exist". We do explicit
	// checks later on to make sure this account is valid for the intended
	// operation. This requires edit permission for completeness and consistency
	// but it won't actually be meaningfully checked because we're using the
	// omnipotent user.

	$account = id(new PhabricatorExternalAccountQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withAccountSecrets(array($account_key))
	->needImages(true)
	->requireCapabilities(
	array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	))
	->executeOne();

	if (!$account) {
	$response = $this->renderError(pht('No valid linkable account.'));
	return array($account, $provider, $response);
	}

	if ($account->getUserPHID()) {
	if ($account->getUserPHID() != $viewer->getPHID()) {
	$response = $this->renderError(
	pht(
	'The account you are attempting to register or link is already '.
	'linked to another user.'));
	} else {
	$response = $this->renderError(
	pht(
	'The account you are attempting to link is already linked '.
	'to your account.'));
	}
	return array($account, $provider, $response);
	}

	$registration_key = $request->getCookie(
	PhabricatorCookies::COOKIE_REGISTRATION);

	// NOTE: This registration key check is not strictly necessary, because
	// we're only creating new accounts, not linking existing accounts. It
	// might be more hassle than it is worth, especially for email.
	//
	// The attack this prevents is getting to the registration screen, then
	// copy/pasting the URL and getting someone else to click it and complete
	// the process. They end up with an account bound to credentials you
	// control. This doesn't really let you do anything meaningful, though,
	// since you could have simply completed the process yourself.

	if (!$registration_key) {
	$response = $this->renderError(
	pht(
	'Your browser did not submit a registration key with the request. '.
	'You must use the same browser to begin and complete registration. '.
	'Check that cookies are enabled and try again.'));
	return array($account, $provider, $response);
	}

	// We store the digest of the key rather than the key itself to prevent a
	// theoretical attacker with read-only access to the database from
	// hijacking registration sessions.

	$actual = $account->getProperty('registrationKey');
	$expect = PhabricatorHash::weakDigest($registration_key);
	if (!phutil_hashes_are_identical($actual, $expect)) {
	$response = $this->renderError(
	pht(
	'Your browser submitted a different registration key than the one '.
	'associated with this account. You may need to clear your cookies.'));
	return array($account, $provider, $response);
	}

	$other_account = id(new PhabricatorExternalAccount())->loadAllWhere(
	'accountType = %s AND accountDomain = %s AND accountID = %s
	AND id != %d',
	$account->getAccountType(),
	$account->getAccountDomain(),
	$account->getAccountID(),
	$account->getID());

	if ($other_account) {
	$response = $this->renderError(
	pht(
	'The account you are attempting to register with already belongs '.
	'to another user.'));
	return array($account, $provider, $response);
	}

	- $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
	- $account->getProviderKey());
	-
	- if (!$provider) {
	+ $config = $account->getProviderConfig();
	+ if (!$config->getIsEnabled()) {
	$response = $this->renderError(
	pht(
	- 'The account you are attempting to register with uses a nonexistent '.
	- 'or disabled authentication provider (with key "%s"). An '.
	- 'administrator may have recently disabled this provider.',
	- $account->getProviderKey()));
	+ 'The account you are attempting to register with uses a disabled '.
	+ 'authentication provider ("%s"). An administrator may have '.
	+ 'recently disabled this provider.',
	+ $config->getDisplayName()));
	return array($account, $provider, $response);
	}

	+ $provider = $config->getProvider();
	+
	return array($account, $provider, null);
	}

	protected function loadInvite() {
	$invite_cookie = PhabricatorCookies::COOKIE_INVITE;
	$invite_code = $this->getRequest()->getCookie($invite_cookie);
	if (!$invite_code) {
	return null;
	}

	$engine = id(new PhabricatorAuthInviteEngine())
	->setViewer($this->getViewer())
	->setUserHasConfirmedVerify(true);

	try {
	return $engine->processInviteCode($invite_code);
	} catch (Exception $ex) {
	// If this fails for any reason, just drop the invite. In normal
	// circumstances, we gave them a detailed explanation of any error
	// before they jumped into this workflow.
	return null;
	}
	}

	protected function renderInviteHeader(PhabricatorAuthInvite $invite) {
	$viewer = $this->getViewer();

	// Since the user hasn't registered yet, they may not be able to see other
	// user accounts. Load the inviting user with the omnipotent viewer.
	$omnipotent_viewer = PhabricatorUser::getOmnipotentUser();

	$invite_author = id(new PhabricatorPeopleQuery())
	->setViewer($omnipotent_viewer)
	->withPHIDs(array($invite->getAuthorPHID()))
	->needProfileImage(true)
	->executeOne();

	// If we can't load the author for some reason, just drop this message.
	// We lose the value of contextualizing things without author details.
	if (!$invite_author) {
	return null;
	}

	$invite_item = id(new PHUIObjectItemView())
	->setHeader(pht('Welcome to Phabricator!'))
	->setImageURI($invite_author->getProfileImageURI())
	->addAttribute(
	pht(
	'%s has invited you to join Phabricator.',
	$invite_author->getFullName()));

	$invite_list = id(new PHUIObjectItemListView())
	->addItem($invite_item)
	->setFlush(true);

	return id(new PHUIBoxView())
	->addMargin(PHUI::MARGIN_LARGE)
	->appendChild($invite_list);
	}

	}
	diff --git a/src/applications/auth/controller/PhabricatorAuthLinkController.php b/src/applications/auth/controller/PhabricatorAuthLinkController.php
	index 44176a278e..4b127b9ad1 100644
	--- a/src/applications/auth/controller/PhabricatorAuthLinkController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthLinkController.php
	@@ -1,127 +1,128 @@
	<?php

	final class PhabricatorAuthLinkController
	extends PhabricatorAuthController {

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$action = $request->getURIData('action');
	- $provider_key = $request->getURIData('pkey');

	- $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
	- $provider_key);
	- if (!$provider) {
	+ $id = $request->getURIData('id');
	+
	+ $config = id(new PhabricatorAuthProviderConfigQuery())
	+ ->setViewer($viewer)
	+ ->withIDs(array($id))
	+ ->withIsEnabled(true)
	+ ->executeOne();
	+ if (!$config) {
	return new Aphront404Response();
	}

	+ $provider = $config->getProvider();
	+
	switch ($action) {
	case 'link':
	if (!$provider->shouldAllowAccountLink()) {
	return $this->renderErrorPage(
	pht('Account Not Linkable'),
	array(
	pht('This provider is not configured to allow linking.'),
	));
	}
	break;
	case 'refresh':
	if (!$provider->shouldAllowAccountRefresh()) {
	return $this->renderErrorPage(
	pht('Account Not Refreshable'),
	array(
	pht('This provider does not allow refreshing.'),
	));
	}
	break;
	default:
	return new Aphront400Response();
	}

	- $account = id(new PhabricatorExternalAccount())->loadOneWhere(
	- 'accountType = %s AND accountDomain = %s AND userPHID = %s',
	- $provider->getProviderType(),
	- $provider->getProviderDomain(),
	- $viewer->getPHID());
	+ $accounts = id(new PhabricatorExternalAccountQuery())
	+ ->setViewer($viewer)
	+ ->withUserPHIDs(array($viewer->getPHID()))
	+ ->withProviderConfigPHIDs(array($config->getPHID()))
	+ ->execute();

	switch ($action) {
	case 'link':
	- if ($account) {
	+ if ($accounts) {
	return $this->renderErrorPage(
	pht('Account Already Linked'),
	array(
	pht(
	'Your Phabricator account is already linked to an external '.
	'account for this provider.'),
	));
	}
	break;
	case 'refresh':
	- if (!$account) {
	+ if (!$accounts) {
	return $this->renderErrorPage(
	pht('No Account Linked'),
	array(
	pht(
	'You do not have a linked account on this provider, and thus '.
	'can not refresh it.'),
	));
	}
	break;
	default:
	return new Aphront400Response();
	}

	$panel_uri = '/settings/panel/external/';

	PhabricatorCookies::setClientIDCookie($request);

	switch ($action) {
	case 'link':
	- id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
	- $viewer,
	- $request,
	- $panel_uri);
	-
	$form = $provider->buildLinkForm($this);
	break;
	case 'refresh':
	$form = $provider->buildRefreshForm($this);
	break;
	default:
	return new Aphront400Response();
	}

	if ($provider->isLoginFormAButton()) {
	require_celerity_resource('auth-css');
	$form = phutil_tag(
	'div',
	array(
	'class' => 'phabricator-link-button pl',
	),
	$form);
	}

	switch ($action) {
	case 'link':
	$name = pht('Link Account');
	$title = pht('Link %s Account', $provider->getProviderName());
	break;
	case 'refresh':
	$name = pht('Refresh Account');
	$title = pht('Refresh %s Account', $provider->getProviderName());
	break;
	default:
	return new Aphront400Response();
	}

	$crumbs = $this->buildApplicationCrumbs();
	$crumbs->addTextCrumb(pht('Link Account'), $panel_uri);
	$crumbs->addTextCrumb($provider->getProviderName($name));
	$crumbs->setBorder(true);

	return $this->newPage()
	->setTitle($title)
	->setCrumbs($crumbs)
	->appendChild($form);
	}

	}
	diff --git a/src/applications/auth/controller/PhabricatorAuthUnlinkController.php b/src/applications/auth/controller/PhabricatorAuthUnlinkController.php
	index 004ddf4f9a..43e7b1b362 100644
	--- a/src/applications/auth/controller/PhabricatorAuthUnlinkController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthUnlinkController.php
	@@ -1,133 +1,141 @@
	<?php

	final class PhabricatorAuthUnlinkController
	extends PhabricatorAuthController {

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$id = $request->getURIData('id');

	$account = id(new PhabricatorExternalAccountQuery())
	->setViewer($viewer)
	->withIDs(array($id))
	->requireCapabilities(
	array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	))
	->executeOne();
	if (!$account) {
	return new Aphront404Response();
	}

	$done_uri = '/settings/panel/external/';

	$config = $account->getProviderConfig();
	$provider = $config->getProvider();
	if (!$provider->shouldAllowAccountUnlink()) {
	return $this->renderNotUnlinkableErrorDialog($provider, $done_uri);
	}

	$confirmations = $request->getStrList('confirmations');
	$confirmations = array_fuse($confirmations);

	- if (!$request->isFormPost() \|\| !isset($confirmations['unlink'])) {
	+ if (!$request->isFormOrHisecPost() \|\| !isset($confirmations['unlink'])) {
	return $this->renderConfirmDialog($confirmations, $config, $done_uri);
	}

	// Check that this account isn't the only account which can be used to
	// login. We warn you when you remove your only login account.
	if ($account->isUsableForLogin()) {
	$other_accounts = id(new PhabricatorExternalAccountQuery())
	->setViewer($viewer)
	->withUserPHIDs(array($viewer->getPHID()))
	->execute();

	$valid_accounts = 0;
	foreach ($other_accounts as $other_account) {
	if ($other_account->isUsableForLogin()) {
	$valid_accounts++;
	}
	}

	if ($valid_accounts < 2) {
	if (!isset($confirmations['only'])) {
	return $this->renderOnlyUsableAccountConfirmDialog(
	$confirmations,
	$done_uri);
	}
	}
	}

	+ $workflow_key = sprintf(
	+ 'account.unlink(%s)',
	+ $account->getPHID());
	+
	+ $hisec_token = id(new PhabricatorAuthSessionEngine())
	+ ->setWorkflowKey($workflow_key)
	+ ->requireHighSecurityToken($viewer, $request, $done_uri);
	+
	$account->delete();

	id(new PhabricatorAuthSessionEngine())->terminateLoginSessions(
	$viewer,
	new PhutilOpaqueEnvelope(
	$request->getCookie(PhabricatorCookies::COOKIE_SESSION)));

	return id(new AphrontRedirectResponse())->setURI($done_uri);
	}

	private function renderNotUnlinkableErrorDialog(
	PhabricatorAuthProvider $provider,
	$done_uri) {

	return $this->newDialog()
	->setTitle(pht('Permanent Account Link'))
	->appendChild(
	pht(
	'You can not unlink this account because the administrator has '.
	'configured Phabricator to make links to "%s" accounts permanent.',
	$provider->getProviderName()))
	->addCancelButton($done_uri);
	}

	private function renderOnlyUsableAccountConfirmDialog(
	array $confirmations,
	$done_uri) {

	$confirmations[] = 'only';

	return $this->newDialog()
	->setTitle(pht('Unlink Your Only Login Account?'))
	->addHiddenInput('confirmations', implode(',', $confirmations))
	->appendParagraph(
	pht(
	'This is the only external login account linked to your Phabicator '.
	'account. If you remove it, you may no longer be able to log in.'))
	->appendParagraph(
	pht(
	'If you lose access to your account, you can recover access by '.
	'sending yourself an email login link from the login screen.'))
	->addCancelButton($done_uri)
	->addSubmitButton(pht('Unlink External Account'));
	}

	private function renderConfirmDialog(
	array $confirmations,
	PhabricatorAuthProviderConfig $config,
	$done_uri) {

	$confirmations[] = 'unlink';
	$provider = $config->getProvider();

	$title = pht('Unlink "%s" Account?', $provider->getProviderName());
	$body = pht(
	'You will no longer be able to use your %s account to '.
	'log in to Phabricator.',
	$provider->getProviderName());

	return $this->newDialog()
	->setTitle($title)
	->addHiddenInput('confirmations', implode(',', $confirmations))
	->appendParagraph($body)
	->appendParagraph(
	pht(
	'Note: Unlinking an authentication provider will terminate any '.
	'other active login sessions.'))
	->addSubmitButton(pht('Unlink Account'))
	->addCancelButton($done_uri);
	}

	}
	diff --git a/src/applications/auth/query/PhabricatorExternalAccountQuery.php b/src/applications/auth/query/PhabricatorExternalAccountQuery.php
	index f67fb4b581..1c5b3fe14f 100644
	--- a/src/applications/auth/query/PhabricatorExternalAccountQuery.php
	+++ b/src/applications/auth/query/PhabricatorExternalAccountQuery.php
	@@ -1,191 +1,204 @@
	<?php

	/**
	* NOTE: When loading ExternalAccounts for use in an authentication context
	* (that is, you're going to act as the account or link identities or anything
	* like that) you should require CAN_EDIT capability even if you aren't actually
	* editing the ExternalAccount.
	*
	* ExternalAccounts have a permissive CAN_VIEW policy (like users) because they
	* interact directly with objects and can leave comments, sign documents, etc.
	* However, CAN_EDIT is restricted to users who own the accounts.
	*/
	final class PhabricatorExternalAccountQuery
	extends PhabricatorCursorPagedPolicyAwareQuery {

	private $ids;
	private $phids;
	private $accountTypes;
	private $accountDomains;
	private $accountIDs;
	private $userPHIDs;
	private $needImages;
	private $accountSecrets;
	+ private $providerConfigPHIDs;

	public function withUserPHIDs(array $user_phids) {
	$this->userPHIDs = $user_phids;
	return $this;
	}

	public function withAccountIDs(array $account_ids) {
	$this->accountIDs = $account_ids;
	return $this;
	}

	public function withAccountDomains(array $account_domains) {
	$this->accountDomains = $account_domains;
	return $this;
	}

	public function withAccountTypes(array $account_types) {
	$this->accountTypes = $account_types;
	return $this;
	}

	public function withPHIDs(array $phids) {
	$this->phids = $phids;
	return $this;
	}

	public function withIDs($ids) {
	$this->ids = $ids;
	return $this;
	}

	public function withAccountSecrets(array $secrets) {
	$this->accountSecrets = $secrets;
	return $this;
	}

	public function needImages($need) {
	$this->needImages = $need;
	return $this;
	}

	+ public function withProviderConfigPHIDs(array $phids) {
	+ $this->providerConfigPHIDs = $phids;
	+ return $this;
	+ }
	+
	public function newResultObject() {
	return new PhabricatorExternalAccount();
	}

	protected function loadPage() {
	return $this->loadStandardPage($this->newResultObject());
	}

	protected function willFilterPage(array $accounts) {
	$viewer = $this->getViewer();

	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer($viewer)
	->withPHIDs(mpull($accounts, 'getProviderConfigPHID'))
	->execute();
	$configs = mpull($configs, null, 'getPHID');

	foreach ($accounts as $key => $account) {
	$config_phid = $account->getProviderConfigPHID();
	$config = idx($configs, $config_phid);

	if (!$config) {
	unset($accounts[$key]);
	continue;
	}

	$account->attachProviderConfig($config);
	}

	if ($this->needImages) {
	$file_phids = mpull($accounts, 'getProfileImagePHID');
	$file_phids = array_filter($file_phids);

	if ($file_phids) {
	// NOTE: We use the omnipotent viewer here because these files are
	// usually created during registration and can't be associated with
	// the correct policies, since the relevant user account does not exist
	// yet. In effect, if you can see an ExternalAccount, you can see its
	// profile image.
	$files = id(new PhabricatorFileQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withPHIDs($file_phids)
	->execute();
	$files = mpull($files, null, 'getPHID');
	} else {
	$files = array();
	}

	$default_file = null;
	foreach ($accounts as $account) {
	$image_phid = $account->getProfileImagePHID();
	if ($image_phid && isset($files[$image_phid])) {
	$account->attachProfileImageFile($files[$image_phid]);
	} else {
	if ($default_file === null) {
	$default_file = PhabricatorFile::loadBuiltin(
	$this->getViewer(),
	'profile.png');
	}
	$account->attachProfileImageFile($default_file);
	}
	}
	}

	return $accounts;
	}

	protected function buildWhereClauseParts(AphrontDatabaseConnection $conn) {
	$where = parent::buildWhereClauseParts($conn);

	if ($this->ids !== null) {
	$where[] = qsprintf(
	$conn,
	'id IN (%Ld)',
	$this->ids);
	}

	if ($this->phids !== null) {
	$where[] = qsprintf(
	$conn,
	'phid IN (%Ls)',
	$this->phids);
	}

	if ($this->accountTypes !== null) {
	$where[] = qsprintf(
	$conn,
	'accountType IN (%Ls)',
	$this->accountTypes);
	}

	if ($this->accountDomains !== null) {
	$where[] = qsprintf(
	$conn,
	'accountDomain IN (%Ls)',
	$this->accountDomains);
	}

	if ($this->accountIDs !== null) {
	$where[] = qsprintf(
	$conn,
	'accountID IN (%Ls)',
	$this->accountIDs);
	}

	if ($this->userPHIDs !== null) {
	$where[] = qsprintf(
	$conn,
	'userPHID IN (%Ls)',
	$this->userPHIDs);
	}

	if ($this->accountSecrets !== null) {
	$where[] = qsprintf(
	$conn,
	'accountSecret IN (%Ls)',
	$this->accountSecrets);
	}

	+ if ($this->providerConfigPHIDs !== null) {
	+ $where[] = qsprintf(
	+ $conn,
	+ 'providerConfigPHID IN (%Ls)',
	+ $this->providerConfigPHIDs);
	+ }
	+
	return $where;
	}

	public function getQueryApplicationClass() {
	return 'PhabricatorPeopleApplication';
	}

	}
	diff --git a/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php b/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php
	index 5cab924255..92bb2e0b86 100644
	--- a/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php
	+++ b/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php
	@@ -1,292 +1,289 @@
	<?php

	final class PhabricatorPeopleProfilePictureController
	extends PhabricatorPeopleProfileController {

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$id = $request->getURIData('id');

	$user = id(new PhabricatorPeopleQuery())
	->setViewer($viewer)
	->withIDs(array($id))
	->needProfileImage(true)
	->requireCapabilities(
	array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	))
	->executeOne();
	if (!$user) {
	return new Aphront404Response();
	}

	$this->setUser($user);
	$name = $user->getUserName();

	$done_uri = '/p/'.$name.'/';

	$supported_formats = PhabricatorFile::getTransformableImageFormats();
	$e_file = true;
	$errors = array();

	if ($request->isFormPost()) {
	$phid = $request->getStr('phid');
	$is_default = false;
	if ($phid == PhabricatorPHIDConstants::PHID_VOID) {
	$phid = null;
	$is_default = true;
	} else if ($phid) {
	$file = id(new PhabricatorFileQuery())
	->setViewer($viewer)
	->withPHIDs(array($phid))
	->executeOne();
	} else {
	if ($request->getFileExists('picture')) {
	$file = PhabricatorFile::newFromPHPUpload(
	$_FILES['picture'],
	array(
	'authorPHID' => $viewer->getPHID(),
	'canCDN' => true,
	));
	} else {
	$e_file = pht('Required');
	$errors[] = pht(
	'You must choose a file when uploading a new profile picture.');
	}
	}

	if (!$errors && !$is_default) {
	if (!$file->isTransformableImage()) {
	$e_file = pht('Not Supported');
	$errors[] = pht(
	'This server only supports these image formats: %s.',
	implode(', ', $supported_formats));
	} else {
	$xform = PhabricatorFileTransform::getTransformByKey(
	PhabricatorFileThumbnailTransform::TRANSFORM_PROFILE);
	$xformed = $xform->executeTransform($file);
	}
	}

	if (!$errors) {
	if ($is_default) {
	$user->setProfileImagePHID(null);
	} else {
	$user->setProfileImagePHID($xformed->getPHID());
	$xformed->attachToObject($user->getPHID());
	}
	$user->save();
	return id(new AphrontRedirectResponse())->setURI($done_uri);
	}
	}

	$title = pht('Edit Profile Picture');

	$form = id(new PHUIFormLayoutView())
	->setUser($viewer);

	$default_image = $user->getDefaultProfileImagePHID();
	if ($default_image) {
	$default_image = id(new PhabricatorFileQuery())
	->setViewer($viewer)
	->withPHIDs(array($default_image))
	->executeOne();
	}

	if (!$default_image) {
	$default_image = PhabricatorFile::loadBuiltin($viewer, 'profile.png');
	}

	$images = array();

	$current = $user->getProfileImagePHID();
	$has_current = false;
	if ($current) {
	$files = id(new PhabricatorFileQuery())
	->setViewer($viewer)
	->withPHIDs(array($current))
	->execute();
	if ($files) {
	$file = head($files);
	if ($file->isTransformableImage()) {
	$has_current = true;
	$images[$current] = array(
	'uri' => $file->getBestURI(),
	'tip' => pht('Current Picture'),
	);
	}
	}
	}

	$builtins = array(
	'user1.png',
	'user2.png',
	'user3.png',
	'user4.png',
	'user5.png',
	'user6.png',
	'user7.png',
	'user8.png',
	'user9.png',
	);
	foreach ($builtins as $builtin) {
	$file = PhabricatorFile::loadBuiltin($viewer, $builtin);
	$images[$file->getPHID()] = array(
	'uri' => $file->getBestURI(),
	'tip' => pht('Builtin Image'),
	);
	}

	// Try to add external account images for any associated external accounts.
	$accounts = id(new PhabricatorExternalAccountQuery())
	->setViewer($viewer)
	->withUserPHIDs(array($user->getPHID()))
	->needImages(true)
	->requireCapabilities(
	array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	))
	->execute();

	foreach ($accounts as $account) {
	$file = $account->getProfileImageFile();
	if ($account->getProfileImagePHID() != $file->getPHID()) {
	// This is a default image, just skip it.
	continue;
	}

	- $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
	- $account->getProviderKey());
	- if ($provider) {
	- $tip = pht('Picture From %s', $provider->getProviderName());
	- } else {
	- $tip = pht('Picture From External Account');
	- }
	+ $config = $account->getProviderConfig();
	+ $provider = $config->getProvider();
	+
	+ $tip = pht('Picture From %s', $provider->getProviderName());

	if ($file->isTransformableImage()) {
	$images[$file->getPHID()] = array(
	'uri' => $file->getBestURI(),
	'tip' => $tip,
	);
	}
	}

	$images[PhabricatorPHIDConstants::PHID_VOID] = array(
	'uri' => $default_image->getBestURI(),
	'tip' => pht('Default Picture'),
	);

	require_celerity_resource('people-profile-css');
	Javelin::initBehavior('phabricator-tooltips', array());

	$buttons = array();
	foreach ($images as $phid => $spec) {
	$style = null;
	if (isset($spec['style'])) {
	$style = $spec['style'];
	}
	$button = javelin_tag(
	'button',
	array(
	'class' => 'button-grey profile-image-button',
	'sigil' => 'has-tooltip',
	'meta' => array(
	'tip' => $spec['tip'],
	'size' => 300,
	),
	),
	phutil_tag(
	'img',
	array(
	'height' => 50,
	'width' => 50,
	'src' => $spec['uri'],
	)));

	$button = array(
	phutil_tag(
	'input',
	array(
	'type' => 'hidden',
	'name' => 'phid',
	'value' => $phid,
	)),
	$button,
	);

	$button = phabricator_form(
	$viewer,
	array(
	'class' => 'profile-image-form',
	'method' => 'POST',
	),
	$button);

	$buttons[] = $button;
	}

	if ($has_current) {
	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('Current Picture'))
	->setValue(array_shift($buttons)));
	}

	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('Use Picture'))
	->setValue($buttons));

	$form_box = id(new PHUIObjectBoxView())
	->setHeaderText($title)
	->setFormErrors($errors)
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
	->setForm($form);

	$upload_form = id(new AphrontFormView())
	->setUser($viewer)
	->setEncType('multipart/form-data')
	->appendChild(
	id(new AphrontFormFileControl())
	->setName('picture')
	->setLabel(pht('Upload Picture'))
	->setError($e_file)
	->setCaption(
	pht('Supported formats: %s', implode(', ', $supported_formats))))
	->appendChild(
	id(new AphrontFormSubmitControl())
	->addCancelButton($done_uri)
	->setValue(pht('Upload Picture')));

	$upload_box = id(new PHUIObjectBoxView())
	->setHeaderText(pht('Upload New Picture'))
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
	->setForm($upload_form);

	$crumbs = $this->buildApplicationCrumbs();
	$crumbs->addTextCrumb(pht('Edit Profile Picture'));
	$crumbs->setBorder(true);

	$nav = $this->getProfileMenu();
	$nav->selectFilter(PhabricatorPeopleProfileMenuEngine::ITEM_MANAGE);

	$header = $this->buildProfileHeader();

	$view = id(new PHUITwoColumnView())
	->setHeader($header)
	->addClass('project-view-home')
	->addClass('project-view-people-home')
	->setFooter(array(
	$form_box,
	$upload_box,
	));

	return $this->newPage()
	->setTitle($title)
	->setCrumbs($crumbs)
	->setNavigation($nav)
	->appendChild($view);
	}
	}
	diff --git a/src/applications/settings/panel/PhabricatorExternalAccountsSettingsPanel.php b/src/applications/settings/panel/PhabricatorExternalAccountsSettingsPanel.php
	index 9904c7369f..60389e1590 100644
	--- a/src/applications/settings/panel/PhabricatorExternalAccountsSettingsPanel.php
	+++ b/src/applications/settings/panel/PhabricatorExternalAccountsSettingsPanel.php
	@@ -1,145 +1,141 @@
	<?php

	final class PhabricatorExternalAccountsSettingsPanel
	extends PhabricatorSettingsPanel {

	public function getPanelKey() {
	return 'external';
	}

	public function getPanelName() {
	return pht('External Accounts');
	}

	public function getPanelMenuIcon() {
	return 'fa-users';
	}

	public function getPanelGroupKey() {
	return PhabricatorSettingsAuthenticationPanelGroup::PANELGROUPKEY;
	}

	public function processRequest(AphrontRequest $request) {
	$viewer = $request->getUser();

	$providers = PhabricatorAuthProvider::getAllProviders();

	$accounts = id(new PhabricatorExternalAccountQuery())
	->setViewer($viewer)
	->withUserPHIDs(array($viewer->getPHID()))
	->needImages(true)
	->requireCapabilities(
	array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	))
	->execute();

	$linked_head = pht('Linked Accounts and Authentication');

	$linked = id(new PHUIObjectItemListView())
	->setUser($viewer)
	->setNoDataString(pht('You have no linked accounts.'));

	foreach ($accounts as $account) {
	$item = new PHUIObjectItemView();

	- $provider = idx($providers, $account->getProviderKey());
	- if ($provider) {
	- $item->setHeader($provider->getProviderName());
	- $can_unlink = $provider->shouldAllowAccountUnlink();
	- if (!$can_unlink) {
	- $item->addAttribute(pht('Permanently Linked'));
	- }
	- } else {
	- $item->setHeader(
	- pht('Unknown Account ("%s")', $account->getProviderKey()));
	- $can_unlink = true;
	+ $config = $account->getProviderConfig();
	+ $provider = $config->getProvider();
	+
	+ $item->setHeader($provider->getProviderName());
	+ $can_unlink = $provider->shouldAllowAccountUnlink();
	+ if (!$can_unlink) {
	+ $item->addAttribute(pht('Permanently Linked'));
	}

	$can_login = $account->isUsableForLogin();
	if (!$can_login) {
	$item->addAttribute(
	pht(
	'Disabled (an administrator has disabled login for this '.
	'account provider).'));
	}

	- $can_refresh = $provider && $provider->shouldAllowAccountRefresh();
	+ $can_refresh = $provider->shouldAllowAccountRefresh();
	if ($can_refresh) {
	$item->addAction(
	id(new PHUIListItemView())
	->setIcon('fa-refresh')
	- ->setHref('/auth/refresh/'.$account->getProviderKey().'/'));
	+ ->setHref('/auth/refresh/'.$config->getID().'/'));
	}

	$item->addAction(
	id(new PHUIListItemView())
	->setIcon('fa-times')
	->setWorkflow(true)
	->setDisabled(!$can_unlink)
	->setHref('/auth/unlink/'.$account->getID().'/'));

	if ($provider) {
	$provider->willRenderLinkedAccount($viewer, $item, $account);
	}

	$linked->addItem($item);
	}

	$linkable_head = pht('Add External Account');

	$linkable = id(new PHUIObjectItemListView())
	->setUser($viewer)
	->setNoDataString(
	pht('Your account is linked with all available providers.'));

	- $accounts = mpull($accounts, null, 'getProviderKey');
	-
	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer($viewer)
	->withIsEnabled(true)
	->execute();
	$configs = msort($configs, 'getSortVector');

	+ $account_map = mgroup($accounts, 'getProviderConfigPHID');
	+
	+
	foreach ($configs as $config) {
	$provider = $config->getProvider();

	if (!$provider->shouldAllowAccountLink()) {
	continue;
	}

	// Don't show the user providers they already have linked.
	- $provider_key = $config->getProvider()->getProviderKey();
	- if (isset($accounts[$provider_key])) {
	+ if (isset($account_map[$config->getPHID()])) {
	continue;
	}

	- $link_uri = '/auth/link/'.$provider->getProviderKey().'/';
	+ $link_uri = '/auth/link/'.$config->getID().'/';

	$link_button = id(new PHUIButtonView())
	->setTag('a')
	->setIcon('fa-link')
	->setHref($link_uri)
	->setColor(PHUIButtonView::GREY)
	->setText(pht('Link External Account'));

	$item = id(new PHUIObjectItemView())
	->setHeader($config->getDisplayName())
	->setHref($link_uri)
	->setImageIcon($config->newIconView())
	->setSideColumn($link_button);

	$linkable->addItem($item);
	}

	$linked_box = $this->newBox($linked_head, $linked);
	$linkable_box = $this->newBox($linkable_head, $linkable);

	return array(
	$linked_box,
	$linkable_box,
	);
	}

	}

File Metadata

Mime Type: text/x-diff
Expires: Sun, Sep 7, 7:24 AM (1 d, 21 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 222542
Default Alt Text: (48 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions