matrix-phpbb-rest.php

<?php

/**
*
* This file is not a part of the phpBB Forum Software package.
* Please be sure what you are doing.
*
* This code is based on code written by Matthias Kesler
* Licensed under the Apache License, Version 2.0 (the "License");
* https://github.com/krombel/matrix-register-bot/
*
*/

# By default we assume the user is not authorised
$response = [
    "auth" => [
        "success" => false,
    ]
];

try {
    $inputJSON = file_get_contents('php://input');
    $input = json_decode($inputJSON, TRUE);
    $domain = $localpart = $password = NULL;

    if (isset($input["auth"]["localpart"])) {
        $localpart = $input["auth"]["localpart"];
    }
    if (empty($localpart)) {
        throw new Exception("localpart cannot be identified");
    }
    if (isset($input["auth"]["password"])) {
        $password = $input["auth"]["password"];
    }
    if (empty($password)) {
        throw new Exception("password is not present");
    }
    if (isset($input["auth"]["domain"])) {
        $domain = $input["auth"]["domain"];
    }
    if ($domain != "example.com") {
        throw new Exception("we do not serve this domain");
    }

    /**
    * Getting phpBB functions, environment and verifying user alias
    */
    define('IN_PHPBB', true);
    $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : '../';
    $phpEx = substr(strrchr(__FILE__, '.'), 1);
    include($phpbb_root_path . 'common.' . $phpEx);
    $sql = sprintf("
SELECT user_password AS password, username AS username
FROM phpbb_users users
LEFT JOIN phpbb_banlist banlist
ON users.user_id = banlist.ban_userid
WHERE users.username_alias = '%s'
AND users.user_type IN (0,3)
AND users.user_posts > 0
AND banlist.ban_id IS NULL",
    utf8_clean_string($localpart)
    );
    $valid = False;
    $result = $db->sql_query($sql);
    $row = $db->sql_fetchrow($result);
    if ( isset($row) == False ) {
        throw new Exception("user not found or password did not match");
    }
    else {
        $valid = phpbb_check_hash($password, $row["password"]);
    }
    if ( $valid == False ) {
        throw new Exception("user not found or password did not match");
    }
    $response["auth"]["success"] = true;
    $response["auth"]["profile"] = [
        "display_name" => $row["username"],
        "three_pids" => [
            [
                "medium" => "email",
                "address" => $localpart . "@" . $domain,
            ],
        ],
    ];
    $response["auth"]["id"] = [
        "type" => "localpart",
        "value" => $localpart
        ];
} catch (Exception $e) {
    error_log("Auth failed with error: " . $e->getMessage());
    $response["auth"]["error"] = $e->getMessage();
}
print (json_encode($response, JSON_PRETTY_PRINT) . "\n");

?>