';
}
- drupal_goto($destination);
+ if (variable_get('fboauth_popup', 1)) {
+ // Close the popup and set the parent window to the target destination.
+ $url = !isset($user->pass) || $user->pass == '' ? url("user/{$user->uid}/edit", array('absolute' => TRUE)) : url($destination);
+ print fboauth_close_popup_window($url);
+ module_invoke_all('exit');
+ exit;
+ }
+ else {
+ drupal_goto($destination);
+ }
}
// In the event of an error, we stay on this page.
@@ -50,6 +71,29 @@ function fboauth_action_page($action) {
}
/**
+ * Returns a HTML string to close the popup modal window and redirect the opener window to the relevant URL.
+ *
+ * @param $url
+ * @return string
+ */
+function fboauth_close_popup_window($url) {
+ return "
+
+
+
+
+ ";
+}
+
+/**
* Invoke an action specified through hook_fboauth_action_info().
*/
function fboauth_action_invoke($action_name, $app_id, $access_token) {
@@ -71,52 +115,147 @@ function fboauth_action_invoke($action_name, $app_id, $access_token) {
function fboauth_action_connect($app_id, $access_token) {
global $user;
- $fbuser = fboauth_graph_query('me', $access_token);
- $uid = fboauth_uid_load($fbuser->id);
+ // Save access_token in session for future use.
+ $_SESSION['fboauth']['access_token'] = $access_token;
- // If the user has logged in before, load their account and login.
- if (!$user->uid && $uid && ($account = user_load($uid))) {
- fboauth_login_user($account);
+ $id = 'me'; // Versions prior to v2.4 and v2.5 are working with just this.
+ if (variable_get('fboauth_apiversion', 'v2.3') == 'v2.5'
+ || variable_get('fboauth_apiversion', 'v2.3') == 'v2.4') {
+ $id .= '?fields=email,name,first_name,last_name,age_range,link,gender,locale,timezone,updated_time,verified,birthday,location';
}
- // If the Facebook e-mail address matches an existing account, bind them
- // together and log in as that account.
- elseif (!empty($fbuser->email) && ($account = user_load(array('mail' => $fbuser->email)))) {
- fboauth_save($account->uid, $fbuser->id);
- // Logins will be denied if the user's account is blocked.
- if ($user->uid || fboauth_login_user($account)) {
- drupal_set_message(t('You\'ve connected your account with Facebook.'));
- }
+ $fbuser = fboauth_graph_query($id, $access_token);
+
+ if (variable_get('fboauth_debug', '') == 1) {
+ watchdog('debug', 'fbuser=' . print_r($fbuser, TRUE) . '
');
}
- else {
- // If the user is already logged in, associate the two accounts.
- if ($user->uid) {
- fboauth_save($user->uid, $fbuser->id);
- drupal_set_message(t('You\'ve connected your account with Facebook.'));
+
+ // Use fake email if user email not available.
+ if (empty($fbuser->email)) {
+ $fbuser->email = $fbuser->id . '@facebook.com';
+ }
+
+ $uid = fboauth_uid_load($fbuser->id);
+ // If the user isn't logged in.
+ if (!$user->uid) {
+ // See if they are connected to FB & is an association between FB & Drupal.
+ if ($uid && ($account = user_load($uid))) {
+ fboauth_login_user($account);
}
- // Register a new user only if allowed.
- elseif (variable_get('user_register', 1)) {
- $account = fboauth_create_user($fbuser);
- // Load the account fresh just to have a fully-loaded object.
- $account = user_load($account->uid);
-
- // If the account requires administrator approval the new account will
- // have a status of '0' and not be activated yet.
- if ($account->status == 0) {
- _user_mail_notify('register_pending_approval', $account);
- drupal_set_message(t('An account has been created for you on @sitename but an administrator needs to approve your account. In the meantime, a welcome message with further instructions has been sent to your e-mail address.', array('@sitename' => variable_get('site_name', ''))));
+ // No association between FB & this Drupal site, yet.
+ // So lets check & see if the FB address matches a Drupal email address.
+ else {
+ if (!empty($fbuser->email)) {
+ $account = NULL;
+
+ // Check and see if multiple_email module is in use.
+ if (module_exists('multiple_email')) {
+ if ($multiple_email_object = multiple_email_find_address($fbuser->email)) {
+ $account = user_load($multiple_email_object->uid);
+ if ($multiple_email_object->confirmed) {
+ // we're good
+ }
+ else {
+ // note: drupal security team doesn't consider it a vulnerabilty that UID is publicly available
+ // https://www.drupal.org/node/1004778
+ drupal_set_message(t("We found your e-mail @email in the @sitename system, but it hasn't been confirmed. " .
+ 'Please login manually and then ' .
+ 'resend your confirmation code to confirm that you are the owner of this email address. This is required before you can connect to the site from Facebook with it.', array(
+ '@email' => $fbuser->email,
+ '@sitename' => variable_get('site_name', ''),
+ '!login' => url('user/login'),
+ '!edit' => url('user/' . $account->uid . '/edit/email-addresses'))));
+ return;
+ }
+ }
+ else {
+ // Email address not found in System
+ }
+ }
+ else {
+ // Just use the e-mail from the users table.
+ $account = user_load_by_mail($fbuser->email);
+ }
+ // If the Facebook e-mail address matches an existing account, bind them
+ // together and log in as that account.
+ if ($account) {
+ // Connect the account only if we allow anonymous users to connect accounts that have
+ // never been connected before.
+ if (variable_get('fboauth_anon_connect', TRUE)) {
+ // Logins will be denied if the user's account is blocked.
+ if (fboauth_login_user($account)) {
+ fboauth_save($account->uid, $fbuser->id);
+ drupal_set_message(t("You've connected your account with Facebook."));
+ }
+ }
+ else {
+ drupal_set_message(t('We found your e-mail @email in the @sitename system, but the account has never been connected to Facebook before. ' .
+ 'Please login manually and connect to Facebook while logged in. ' .
+ 'Once you have completed this step, you may login through Facebook whenever you like.', array(
+ '@email' => $fbuser->email,
+ '@sitename' => variable_get('site_name', ''),
+ '!login' => url('user/login'),
+ '!edit' => url('user/' . $account->uid . '/edit'))));
+ }
+ }
+ // Register a new user only if allowed.
+ elseif (variable_get('user_register', 1)) {
+ $account = fboauth_create_user($fbuser);
+
+ if (!isset($account) || empty($account)) {
+ drupal_set_message(t('Unable to create a new account using your Facebook profile.'), 'warning');
+ return;
+ }
+
+ // Load the account fresh just to have a fully-loaded object.
+ $account = user_load($account->uid);
+
+ // If the account requires administrator approval the new account will
+ // have a status of '0' and not be activated yet.
+ if ($account->status == 0) {
+ _user_mail_notify('register_pending_approval', $account);
+ drupal_set_message(
+ t('An account has been created for you on @sitename but an ' .
+ 'administrator needs to approve your account. In the meantime, ' .
+ 'a welcome message with further instructions has been sent ' .
+ 'to your e-mail address.', array(
+ '@sitename' => variable_get('site_name', ''))));
+ }
+ // Log in the user if no approval is required.
+ elseif (fboauth_login_user($account)) {
+ drupal_set_message(t('Welcome to @sitename. ' .
+ 'Basic information has been imported from Facebook into your account. ' .
+ 'You may want to edit your account to confirm the ' .
+ 'details and set a password.', array(
+ '@sitename' => variable_get('site_name', ''),
+ '!edit' => url('user/' . $account->uid . '/edit'))));
+ }
+ // If the login fails, fboauth_login_user() throws an error message.
+ }
+ // Since user's can't create new accounts on their own, show an error.
+ else {
+ drupal_set_message(t('Your Facebook e-mail address does not match
+ any existing accounts. If you have an account, you must first
+ log in before you can connect your account to Facebook.
+ Creation of new accounts on this site is disabled.'));
+ }
}
- // Log in the user if no approval is required.
- elseif (fboauth_login_user($account)) {
- drupal_set_message(t('Welcome to @sitename. Basic information has been imported from Facebook into your account. You may want to edit your account to confirm the details and set a password.', array('@sitename' => variable_get('site_name', ''), '!edit' => url('user/' . $account->uid . '/edit'))));
+ // Email not provided by Facebook.
+ else {
+ drupal_set_message(t("Facebook didn't provide an e-mail address " .
+ "to be associated with your account, so we can't compare it " .
+ "with the e-mail addresses in this system."));
+ return;
}
- // If the login fails, fboauth_login_user() throws its own error message.
- }
- // Since user's can't create new accounts on their own, show an error.
- else {
- drupal_set_message(t('Your Facebook e-mail address does not match any existing accounts. If you have an account, you must first log in before you can connect your account to Facebook. Creation of new accounts on this site is disabled.'));
+ // Done if no e-mail address provided by facebook.
}
}
+ else {
+ // The user is already logged in to Drupal.
+ // So just associate the two accounts.
+ fboauth_save($user->uid, $fbuser->id);
+ drupal_set_message(t("You've connected your account with Facebook."));
+ }
}
/**
@@ -126,10 +265,10 @@ function fboauth_action_deauth($app_id, $access_token) {
global $user;
// Deauthorize our application from Facebook.
- $result = fboauth_method_invoke('auth.revokeAuthorization', $access_token);
+ $result = fboauth_graph_query('me/permissions', $access_token, array(), 'DELETE');
// If successful, also remove the uid-fbid pairing.
- if (!is_array($result) && $result) {
+ if (isset($result->success) && $result->success) {
$fbid = fboauth_fbid_load($user->uid);
fboauth_save($user->uid, NULL);
@@ -156,15 +295,19 @@ function fboauth_create_user($fbuser, $options = array()) {
);
$options += $defaults;
- // Use their Facebook user name (if defined), otherwise their real name.
+ // Depending on settings use profile id or real name for drupal username.
+ switch ($options['username']) {
+ case 'name':
+ $username = $fbuser->name;
+ break;
+
+ case 'id':
+ $username = $fbuser->id;
+ break;
+ }
+
// If an account already exists with that name, increment until the namespace
// is available.
- if ($options['username'] === 'username' && !empty($fbuser->username)) {
- $username = $fbuser->username;
- }
- else {
- $username = $fbuser->name;
- }
$query = "SELECT uid FROM {users} WHERE name = '%s'";
$uid = db_result(db_query($query, $username));
$i = 0;
@@ -180,8 +323,10 @@ function fboauth_create_user($fbuser, $options = array()) {
$edit = array(
'name' => $username,
'mail' => !empty($fbuser->email) ? $fbuser->email : '',
+ 'init' => !empty($fbuser->email) ? $fbuser->email : '',
// If user_register is "1", then no approval required.
'status' => $options['status'],
+ 'timezone' => variable_get('date_default_timezone'),
'fboauth' => TRUE, // Signify this is being imported by Facebook OAuth.
'fboauth_fbid' => $fbuser->id, // So that other modules can load the account.
);
@@ -198,13 +343,27 @@ function fboauth_create_user($fbuser, $options = array()) {
$function($edit, $fbuser);
}
+ // check for a valid email address and username and if they don't exist return NULL
+ if (!isset($edit) || empty($edit)) {
+ watchdog('fboauth', 'Account information not provided.');
+ return NULL;
+ }
+ if (!isset($edit['mail']) || empty($edit['mail'])) {
+ watchdog('fboauth', 'Email address not provided by Facebook.');
+ return NULL;
+ }
+ if (!isset($edit['name']) || empty($edit['name'])) {
+ watchdog('fboauth', 'Username not able to be retrieved from Facebook or be generated.');
+ return NULL;
+ }
+
$account = user_save(NULL, $edit);
// Retrieve the user's picture from Facebook and save it locally.
if ($account->uid && $options['picture'] === 'picture') {
$path = file_create_path('pictures');
file_check_directory($path, FILE_CREATE_DIRECTORY);
- $picture_result = drupal_http_request('https://graph.facebook.com/' . $fbuser->id . '/picture?type=large');
+ $picture_result = drupal_http_request('https://graph.facebook.com/' . variable_get('fboauth_apiversion', 'v2.3') . '/'. $fbuser->id . '/picture?type=large');
$picture_path = $path . '/picture-' . $account->uid . '.jpg';
$file = fopen($picture_path, 'w');
fwrite($file, $picture_result->data);
@@ -278,8 +437,19 @@ function fboauth_access_token($code, $action_name, $app_id = NULL, $app_secret =
'redirect_uri' => fboauth_action_url('fboauth/' . $action_name, array('absolute' => TRUE, 'query' => !empty($_GET['destination']) ? array('destination' => $_GET['destination']) : array())),
'code' => $code,
);
- $token_url = url('https://graph.facebook.com/oauth/access_token', array('absolute' => TRUE, 'query' => $query));
- $authentication_result = drupal_http_request($token_url);
+
+ $token_url = url('https://graph.facebook.com/' . variable_get('fboauth_apiversion', 'v2.3') . '/oauth/access_token', array('absolute' => TRUE, 'query' => $query));
+
+ $attempts = 5;
+ do {
+ $authentication_result = drupal_http_request($token_url);
+ if ($authentication_result->code == 200) {
+ break;
+ }
+ // Facebook access code generation seems to take a lot of time. That's why we have to wait
+ // some seconds before the code can be acquired.
+ sleep(1);
+ } while (--$attempts > 0);
if ($authentication_result->code != 200) {
$error = !empty($authentication_result->error) ? $authentication_result->error : t('(no error returned)');
@@ -287,14 +457,7 @@ function fboauth_access_token($code, $action_name, $app_id = NULL, $app_secret =
watchdog('fboauth', 'Facebook OAuth could not acquire an access token from Facebook. We queried the following URL: @url
@return