WordPress.org
Get WordPress

Plugin Directory

Changeset 2106419


Ignore:
Timestamp:
06/14/2019 07:45:14 PM (7 years ago)
Author:
VanillaForums
Message:

Update jsConnect client library

Location:
vanilla-forums/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • vanilla-forums/trunk/README.md

    r1076175 r2106419  
    33
    44The official Vanilla Forums Wordpress plugin.
     5
     6# Updating Vanilla-WordPress plugin using subversion
     7
     8Vanilla-WordPress URL https://plugins.svn.wordpress.org/vanilla-forums.
     9
     10WordPress uses subversion (SVN) which is a free open source version control.
     11
     12## SVN Installation
     13```sh
     14brew install subversion
     15```
     16## SVN Client
     17
     18TurtoiseSVN for Windows or SCPlugin for MAC.
     19
     20## SVN Checkout
     21
     22* Pick a directory on your local machine you want subversion to track.Ex. wordpress-plugin-public/vanilla-forums.
     23
     24* To start tracking the project, we need to hook our local Vanilla-forums WordPress plugin. Right-click wordpress-plugin-public/vanilla-forums and choose svn checkout
     25
     26**URL of the repository should be**
     27
     28https://plugins.svn.wordpress.org/vanilla-forums
     29
     30**Checkout directory should be**
     31
     32wordpress-plugin-public/vanilla-forums
     33
     34
     35Your subversion client will begin to pull all of the files as they currently stand on the subversion server.
     36
     37Open wordpress-plugin-public/vanilla-forums you should see a .svn folder, branches, tags and trunk.
     38
     39## Folders Strcuture
     40
     41**Trunk**: contains the latest version of the plugin.
     42
     43**Tags**: contains the public ready version which is a copy of the trunk.
     44
     45## Pushing updates to SVN server
     46
     47Copy your changes for the local Vanilla-wordpress plugin folder and paste it in the trunk folder, make sure you update the plugin version in readme.txt file.
     48
     49Right click on wordpress-plugin-public/vanilla-forums and choose svn commit.
     50
     51You will be asked to provide Vanilla's WordPress username and password.
     52
     53*When you do a commit, the username to use is from readme.txt/Contributors, it is case-sensitive.*
     54
     55## Tagging a version
     56
     57Once you are ready for the public to use your plugin, you need to tag a version to set asside and leave alone.
     58
     59Right click on wordpress-plugin-public/vanilla-forums/trunk and choose SVN Branch/Tag.
     60
     61In the "to path" add a /vanilla-forums/tags/version(ex. tags/1.1.18).
     62
     63
     64
     65
     66

  • vanilla-forums/trunk/functions.jsconnect.php

    r504512 r2106419  
    11<?php
    22/**
    3  * @version 1.0b
    4  * @copyright Copyright 2008, 2009 Vanilla Forums Inc.
    5  * @license http://www.opensource.org/licenses/gpl-2.0.php GPLv2
     3 * This file contains the client code for Vanilla jsConnect single sign on.
     4 *
     5 * @author Todd Burry <[email protected]>
     6 * @version 2.0
     7 * @copyright 2008-2017 Vanilla Forums, Inc.
     8 * @license GNU GPLv2 http://www.opensource.org/licenses/gpl-2.0.php
    69 */
    710
    811define('JS_TIMEOUT', 24 * 60);
    912
    10 function WriteJsConnect($User, $Request, $ClientID, $Secret, $Secure = TRUE) {
    11    $User = array_change_key_case($User);
    12    
    13    // Error checking.
    14    if ($Secure) {
    15       // Check the client.
    16       if (!isset($Request['client_id']))
    17          $Error = array('error' => 'invalid_request', 'message' => 'The client_id parameter is missing.');
    18       elseif ($Request['client_id'] != $ClientID)
    19          $Error = array('error' => 'invalid_client', 'message' => "Unknown client {$Request['client_id']}.");
    20       elseif (!isset($Request['timestamp']) && !isset($Request['signature'])) {
    21          if (is_array($User) && count($User) > 0) {
    22             // This isn't really an error, but we are just going to return public information when no signature is sent.
    23             $Error = array('name' => $User['name'], 'photourl' => @$User['photourl']);
    24          } else {
    25             $Error = array('name' => '', 'photourl' => '');
    26          }
    27       } elseif (!isset($Request['timestamp']) || !is_numeric($Request['timestamp']))
    28          $Error = array('error' => 'invalid_request', 'message' => 'The timestamp parameter is missing or invalid.');
    29       elseif (!isset($Request['signature']))
    30          $Error = array('error' => 'invalid_request', 'message' => 'Missing  signature parameter.');
    31       elseif (($Diff = abs($Request['timestamp'] - JsTimestamp())) > JS_TIMEOUT)
    32          $Error = array('error' => 'invalid_request', 'message' => 'The timestamp is invalid.');
    33       else {
    34          // Make sure the timestamp hasn't timed out.
    35          $Signature = md5($Request['timestamp'].$Secret);
    36          if ($Signature != $Request['signature'])
    37             $Error = array('error' => 'access_denied', 'message' => 'Signature invalid.');
    38       }
    39    }
    40    
    41    if (isset($Error))
    42       $Result = $Error;
    43    elseif (is_array($User) && count($User) > 0) {
    44       if ($Secure === NULL) {
    45          $Result = $User;
    46       } else {
    47          $Result = SignJsConnect($User, $ClientID, $Secret, TRUE);
    48       }
    49    } else
    50       $Result = array('name' => '', 'photourl' => '');
    51    
    52    $Json = json_encode($Result);
    53    
    54    
    55    if (isset($Request['callback'])) {
    56       header("Content-Type: application/javascript");
    57       echo "{$Request['callback']}($Json);";
    58    } else {
    59       header("Content-Type: application/json");
    60       echo $Json;
    61    }
     13/**
     14 * Write the jsConnect string for single sign on.
     15 *
     16 * @param array $user An array containing information about the currently signed on user. If no user is signed in then this should be an empty array.
     17 * @param array $request An array of the $_GET request.
     18 * @param string $clientID The string client ID that you set up in the jsConnect settings page.
     19 * @param string $secret The string secret that you set up in the jsConnect settings page.
     20 * @param string|bool $secure Whether or not to check for security. This is one of these values.
     21 *  - true: Check for security and sign the response with an md5 hash.
     22 *  - false: Don't check for security, but sign the response with an md5 hash.
     23 *  - string: Check for security and sign the response with the given hash algorithm. See hash_algos() for what your server can support.
     24 *  - null: Don't check for security and don't sign the response.
     25 * @since 1.1b Added the ability to provide a hash algorithm to $secure.
     26 */
     27function writeJsConnect($user, $request, $clientID, $secret, $secure = true) {
     28    $user = array_change_key_case($user);
     29
     30    // Error checking.
     31    if ($secure) {
     32        // Check the client.
     33        if (!isset($request['v'])) {
     34            $error = ['error' => 'invalid_request', 'message' => 'Missing the v parameter.'];
     35        } elseif ($request['v'] !== '2') {
     36            $error = ['error' => 'invalid_request', 'message' => "Unsupported version {$request['v']}."];
     37        } elseif (!isset($request['client_id'])) {
     38            $error = ['error' => 'invalid_request', 'message' => 'The client_id parameter is missing.'];
     39        } elseif ($request['client_id'] != $clientID) {
     40            $error = ['error' => 'invalid_client', 'message' => "Unknown client {$request['client_id']}."];
     41        } elseif (!isset($request['timestamp']) && !isset($request['sig'])) {
     42            if (is_array($user) && count($user) > 0) {
     43                // This isn't really an error, but we are just going to return public information when no signature is sent.
     44                $error = ['name' => (string)@$user['name'], 'photourl' => @$user['photourl'], 'signedin' => true];
     45            } else {
     46                $error = ['name' => '', 'photourl' => ''];
     47            }
     48        } elseif (!isset($request['timestamp']) || !is_numeric($request['timestamp'])) {
     49            $error = ['error' => 'invalid_request', 'message' => 'The timestamp parameter is missing or invalid.'];
     50        } elseif (!isset($request['sig'])) {
     51            $error = ['error' => 'invalid_request', 'message' => 'Missing sig parameter.'];
     52        } // Make sure the timestamp hasn't timedout
     53        elseif (abs($request['timestamp'] - jsTimestamp()) > JS_TIMEOUT) {
     54            $error = ['error' => 'invalid_request', 'message' => 'The timestamp is invalid.'];
     55        } elseif (!isset($request['nonce'])) {
     56            $error = ['error' => 'invalid_request', 'message' => 'Missing nonce parameter.'];
     57        } elseif (!isset($request['ip'])) {
     58            $error = ['error' => 'invalid_request', 'message' => 'Missing ip parameter.'];
     59        } else {
     60            $signature = jsHash($request['ip'].$request['nonce'].$request['timestamp'].$secret, $secure);
     61            if ($signature != $request['sig']) {
     62                $error = ['error' => 'access_denied', 'message' => 'Signature invalid.'];
     63            }
     64        }
     65    }
     66
     67    if (isset($error)) {
     68        $result = $error;
     69    } elseif (is_array($user) && count($user) > 0) {
     70        if ($secure === null) {
     71            $result = $user;
     72        } else {
     73            $user['ip'] = $request['ip'];
     74            $user['nonce'] = $request['nonce'];
     75            $result = signJsConnect($user, $clientID, $secret, $secure, true);
     76            $result['v'] = '2';
     77        }
     78    } else {
     79        $result = ['name' => '', 'photourl' => ''];
     80    }
     81
     82    $json = json_encode($result);
     83
     84    if (isset($request['callback'])) {
     85        echo "{$request['callback']}($json)";
     86    } else {
     87        echo $json;
     88    }
    6289}
    6390
    64 function SignJsConnect($Data, $ClientID, $Secret, $ReturnData = FALSE) {
    65    $Data = array_change_key_case($Data);
    66    ksort($Data);
     91/**
     92 *
     93 *
     94 * @param $data
     95 * @param $clientID
     96 * @param $secret
     97 * @param $hashType
     98 * @param bool $returnData
     99 * @return array|string
     100 */
     101function signJsConnect($data, $clientID, $secret, $hashType, $returnData = false) {
     102    $normalizedData = array_change_key_case($data);
     103    ksort($normalizedData);
    67104
    68    foreach ($Data as $Key => $Value) {
    69       if ($Value === NULL)
    70          $Data[$Key] = '';
    71    }
    72    
    73    $String = http_build_query($Data);
    74 //   echo "$String\n";
    75    $Signature = md5($String.$Secret);
    76    
    77    if ($ReturnData) {
    78       $Data['client_id'] = $ClientID;
    79       $Data['signature'] = $Signature;
    80 //      $Data['string'] = $String;
    81       return $Data;
    82    } else {
    83       return $Signature;
    84    }
     105    foreach ($normalizedData as $key => $value) {
     106        if ($value === null) {
     107            $normalizedData[$key] = '';
     108        }
     109    }
     110
     111    $stringifiedData = http_build_query($normalizedData, null, '&');
     112    $signature = jsHash($stringifiedData.$secret, $hashType);
     113    if ($returnData) {
     114        $normalizedData['client_id'] = $clientID;
     115        $normalizedData['sig'] = $signature;
     116        return $normalizedData;
     117    } else {
     118        return $signature;
     119    }
    85120}
    86121
    87 function JsTimestamp() {
    88    return time();
     122/**
     123 * Return the hash of a string.
     124 *
     125 * @param string $string The string to hash.
     126 * @param string|bool $secure The hash algorithm to use. true means md5.
     127 * @return string
     128 */
     129function jsHash($string, $secure = true) {
     130    if ($secure === true) {
     131        $secure = 'md5';
     132    }
     133
     134    switch ($secure) {
     135        case 'sha1':
     136            return sha1($string);
     137            break;
     138        case 'md5':
     139        case false:
     140            return md5($string);
     141        default:
     142            return hash($secure, $string);
     143    }
    89144}
     145
     146/**
     147 *
     148 *
     149 * @return int
     150 */
     151function jsTimestamp() {
     152    return time();
     153}
     154
     155/**
     156 * Generate an SSO string suitable for passing in the url for embedded SSO.
     157 *
     158 * @param array $user The user to sso.
     159 * @param string $clientID Your client ID.
     160 * @param string $secret Your secret.
     161 * @return string
     162 */
     163function jsSSOString($user, $clientID, $secret) {
     164    if (!isset($user['client_id'])) {
     165        $user['client_id'] = $clientID;
     166    }
     167
     168    $string = base64_encode(json_encode($user));
     169    $timestamp = time();
     170    $hash = hash_hmac('sha1', "$string $timestamp", $secret);
     171
     172    $result = "$string $hash $timestamp hmacsha1";
     173    return $result;
     174}

  • vanilla-forums/trunk/plugin.php

    r1872783 r2106419  
    22/*
    33Plugin Name: Vanilla Forums
    4 Plugin URI: http://vanillaforums.org/addons/
     4Plugin URI: https://vanillaforums.com
    55Description: Integrates Vanilla Forums with WordPress: embedded blog comments, embedded forum, single sign on, and WordPress widgets.
    6 Version: 1.1.18
    7 Author: Todd Burry
    8 Author URI: http://www.vanillaforums.org/
     6Version: 1.2
     7Author: Vanilla Forums
     8Author URI: https://vanillaforums.com
    99
    1010ChangeLog:
    … …  
    68681.1.18
    6969- Update handling of /categories/all.json
     701.2
     71- Update jsConnect client library
    7072
    7173Copyright 2010-2016 Vanilla Forums Inc

  • vanilla-forums/trunk/readme.txt

    r1872824 r2106419  
    44Requires at least: 3
    55Tested up to: 4.9.5
    6 Stable tag: 1.1.18
     6Stable tag: 1.2
    77
    88== Description ==

  • vanilla-forums/trunk/sso.php

    r538512 r2106419  
    99$VFRequest = vf_get_value('VFRequest', $_GET);
    1010switch ($VFRequest) {
    11     // Show the signed in user
    12     case 'connect':
    13       require_once dirname(__FILE__).'/functions.jsconnect.php';
    14      
    15       $user = vf_get_user();
    16         $options = get_option(VF_OPTIONS_NAME);
    17         $clientID = vf_get_value('sso-clientid', $options, '');
    18         $secret = vf_get_value('sso-secret', $options, '');
    19         WriteJsConnect($user, $_GET, $clientID, $secret, true);
    20         exit();
    21         break;
    22     // Generate a secret to be used for security.
    23     case 'generate-secret':
    24         echo md5(time());
    25         exit();
    26         break;
     11    // Show the signed in user
     12    case 'connect':
     13        require_once dirname(__FILE__).'/functions.jsconnect.php';
     14        $user = vf_get_user();
     15        $options = get_option(VF_OPTIONS_NAME);
     16        $clientID = vf_get_value('sso-clientid', $options, '');
     17        $secret = vf_get_value('sso-secret', $options, '');
     18        WriteJsConnect($user, $_GET, $clientID, $secret, true);
     19        exit();
     20        break;
     21    // Generate a secret to be used for security.
     22    case 'generate-secret':
     23        echo wp_generate_password(64, true, true);
     24        exit();
     25        break;
    2726}
Note: See TracChangeset for help on using the changeset viewer.