added support for temporary storage of nonces

diff --git a/classes/OpenID_ElggStore.php b/classes/OpenID_ElggStore.php
index 5f6c63e42163b8476f3f37a47ec7aa634b572d2a..35f4797a1122c94a5db15b2957cbbe5181d18be7 100644 (file)
--- a/classes/OpenID_ElggStore.php
+++ b/classes/OpenID_ElggStore.php
@@ -150,7 +150,7 @@ class OpenID_ElggStore extends Auth_OpenID_OpenIDStore {
        /**
         * Can we use this nonce?
         *
-        * Checks time skew and replay
+        * Checks for time skew and replay attacks
         *
         * @param type $server_url The identity server endpoint
         * @param type $timestamp  The timestamp from the nonce
@@ -164,8 +164,49 @@ class OpenID_ElggStore extends Auth_OpenID_OpenIDStore {
                        return false;
                }
 
-               // @todo
-               // we should check if nonce has been used before to guard against replays
+               if (!$this->addNonce($server_url, $timestamp, $salt)) {
+                       return false;
+               }
+
+               return true;
+       }
+
+       /**
+        * Store the nonce to prevent replay attacks
+        *
+        * @param string $server_url
+        * @param string $timestamp
+        * @param string $salt
+        * @return bool
+        */
+       protected function addNonce($server_url, $timestamp, $salt) {
+               global $Auth_OpenID_SKEW;
+
+               $identifier = md5($server_url . $timestamp . $salt);
+
+               // was the nonce already used
+               $count = elgg_get_entities_from_metadata(array(
+                       'type' => 'object',
+                       'subtype' => 'openid_client::nonce',
+                       'metadata_name' => 'identifier',
+                       'metadata_value' => $identifier,
+                       'count' => true,
+               ));
+               if ($count) {
+                       return false;
+               }
+
+               // add it
+               $object = new ElggObject();
+               $object->subtype = 'openid_client::nonce';
+               $object->owner_guid = 0;
+               $object->container_guid = 0;
+               $object->access_id = ACCESS_PUBLIC;
+               $object->server_url = $server_url;
+               $object->expires = $timestamp + $Auth_OpenID_SKEW;
+               $object->identifier = $identifier;
+               $object->save();
+
                return true;
        }
 
@@ -175,12 +216,22 @@ class OpenID_ElggStore extends Auth_OpenID_OpenIDStore {
         * @return int
         */
        public function cleanupNonces() {
-               global $Auth_OpenID_SKEW;
-               $cutoff = time() - $Auth_OpenID_SKEW;
+               $options = array(
+                       'type' => 'object',
+                       'subtype' => 'openid_client::nonce',
+                       'metadata_name_value_pairs' => array(
+                               array('name' => 'expires', 'value' => time(), 'operand' => '<')
+                       ),
+                       'limit' => 0,
+               );
+               $nonces = elgg_get_entities_from_metadata($options);
+               $total = count($nonces);
 
-               // @todo
+               foreach ($nonces as $nonce) {
+                       $nonce->delete();
+               }
 
-               return 0;
+               return $total;
        }
 
        /**

diff --git a/lib/openid_consumer.php b/lib/openid_consumer.php
index 3dfc09a1e9f09cd6ca7f9869dffcdcd24528898c..86b051c0c356e934d6c4a677c288089dedbd5883 100644 (file)
--- a/lib/openid_consumer.php
+++ b/lib/openid_consumer.php
@@ -12,3 +12,4 @@ require_once 'Auth/OpenID.php';
 require_once 'Auth/OpenID/Consumer.php';
 require_once 'Auth/OpenID/SReg.php';
 require_once 'Auth/OpenID/AX.php';
+require_once 'Auth/OpenID/Interface.php';