AuthenticationToken.php
103 lines
| 1 | <?php |
| 2 | |
| 3 | /** |
| 4 | * Matomo - free/libre analytics platform |
| 5 | * |
| 6 | * @link https://matomo.org |
| 7 | * @license https://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later |
| 8 | */ |
| 9 | namespace Piwik\Request; |
| 10 | |
| 11 | use Piwik\Request; |
| 12 | use Piwik\SettingsServer; |
| 13 | /** |
| 14 | * Main class to handle actions related to auth tokens. |
| 15 | */ |
| 16 | class AuthenticationToken |
| 17 | { |
| 18 | protected $authToken = ''; |
| 19 | protected $wasTokenProvidedSecurely = \false; |
| 20 | protected $isSessionToken = \false; |
| 21 | /** |
| 22 | * @param array|null $request |
| 23 | * @return string |
| 24 | */ |
| 25 | public function getAuthToken(?array $request = null) : string |
| 26 | { |
| 27 | $this->detectToken(); |
| 28 | if ($request !== null) { |
| 29 | return (new Request($request))->getStringParameter('token_auth', ''); |
| 30 | } |
| 31 | return $this->authToken; |
| 32 | } |
| 33 | /** |
| 34 | * Returns true if a token_auth parameter was supplied via a secure mechanism and is not present as a URL parameter |
| 35 | * |
| 36 | * @return bool True if token was supplied in a secure way |
| 37 | */ |
| 38 | public function wasTokenAuthProvidedSecurely() : bool |
| 39 | { |
| 40 | $this->detectToken(); |
| 41 | return $this->wasTokenProvidedSecurely; |
| 42 | } |
| 43 | public function isSessionToken() : bool |
| 44 | { |
| 45 | $this->detectToken(); |
| 46 | return $this->isSessionToken; |
| 47 | } |
| 48 | private function detectToken() : void |
| 49 | { |
| 50 | $this->initTokenFromHeader() || $this->initTokenFromJsonRequestBody() || $this->initTokenFromPostRequest() || $this->initTokenFromGetRequest(); |
| 51 | } |
| 52 | private function initTokenFromHeader() : bool |
| 53 | { |
| 54 | if (!empty($_SERVER['HTTP_AUTHORIZATION']) && strpos($_SERVER['HTTP_AUTHORIZATION'], 'Bearer ') === 0) { |
| 55 | $this->authToken = substr($_SERVER['HTTP_AUTHORIZATION'], 7); |
| 56 | $this->wasTokenProvidedSecurely = \true; |
| 57 | return \true; |
| 58 | } |
| 59 | return \false; |
| 60 | } |
| 61 | private function initTokenFromJsonRequestBody() : bool |
| 62 | { |
| 63 | // Token in JSON request body is only support for tracking requests |
| 64 | if (!SettingsServer::isTrackerApiRequest()) { |
| 65 | return \false; |
| 66 | } |
| 67 | $requestBody = file_get_contents('php://input'); |
| 68 | if (!empty($requestBody) && strpos($requestBody, '{') === 0) { |
| 69 | $jsonContent = json_decode($requestBody, \true); |
| 70 | if (!empty($jsonContent['token_auth']) && is_string($jsonContent['token_auth'])) { |
| 71 | $this->authToken = $jsonContent['token_auth']; |
| 72 | $this->wasTokenProvidedSecurely = \true; |
| 73 | return \true; |
| 74 | } |
| 75 | } |
| 76 | return \false; |
| 77 | } |
| 78 | private function initTokenFromPostRequest() : bool |
| 79 | { |
| 80 | $request = Request::fromPost(); |
| 81 | $tokenAuth = $request->getStringParameter('token_auth', ''); |
| 82 | if ($tokenAuth !== '') { |
| 83 | $this->authToken = $tokenAuth; |
| 84 | $this->wasTokenProvidedSecurely = \true; |
| 85 | $this->isSessionToken = $request->getBoolParameter('force_api_session', \false); |
| 86 | return \true; |
| 87 | } |
| 88 | return \false; |
| 89 | } |
| 90 | private function initTokenFromGetRequest() : bool |
| 91 | { |
| 92 | $request = Request::fromGet(); |
| 93 | $tokenAuth = $request->getStringParameter('token_auth', ''); |
| 94 | if ($tokenAuth !== '') { |
| 95 | $this->authToken = $tokenAuth; |
| 96 | $this->wasTokenProvidedSecurely = \false; |
| 97 | $this->isSessionToken = $request->getBoolParameter('force_api_session', \false); |
| 98 | return \true; |
| 99 | } |
| 100 | return \false; |
| 101 | } |
| 102 | } |
| 103 |