Merge pull request #34 from gear4dave/master

Authentication fixes
10REM · Apr 27, 2019 · c76c163 · c76c163
2 parents 53a89b8 + 605de46
commit c76c163
Show file tree

Hide file tree

Showing 5 changed files with 59 additions and 42 deletions.
diff --git a/composer.json b/composer.json
@@ -1,17 +1,19 @@
-{
-  "name": "dawguk/php-garmin-connect",
-  "description": "A PHP adapter for interrogating the Garmin Connect \"API\"",
-  "require": {
-    "php": ">=5.3.0"
-  },
-  "license": "MIT",
-  "autoload": {
-    "classmap": [
-      "src/"
-    ]
-  },
-  "include-path": ["src/"],
-  "require-dev": {
-    "squizlabs/php_codesniffer": "2.8.*"
-  }
-}
+{
+  "name": "dawguk/php-garmin-connect",
+  "description": "A PHP adapter for interrogating the Garmin Connect \"API\"",
+  "require": {
+    "php": ">=5.3.0",
+    "ext-curl": "*",
+    "ext-json": "*"
+  },
+  "license": "MIT",
+  "autoload": {
+    "classmap": [
+      "src/"
+    ]
+  },
+  "include-path": ["src/"],
+  "require-dev": {
+    "squizlabs/php_codesniffer": "2.8.*"
+  }
+}
diff --git a/composer.lock b/composer.lock
diff --git a/examples/example.php b/examples/example.php
@@ -2,16 +2,16 @@
 require_once __DIR__ . '/../vendor/autoload.php';
 
 $arrCredentials = array(
-   'username' => 'xxx',
-   'password' => 'xxx'
+    'username' => 'xxx',
+    'password' => 'xxx'
 );
 
 try {
-   $objGarminConnect = new \dawguk\GarminConnect($arrCredentials);
+    $objGarminConnect = new \dawguk\GarminConnect($arrCredentials);
 
-   $objResults = $objGarminConnect->getActivityList(0, 1);
-   print_r($objResults);
+    $objResults = $objGarminConnect->getActivityList(0, 1);
+    print_r($objResults);
 
 } catch (Exception $objException) {
-   echo "Oops: " . $objException;
+    echo "Oops: " . $objException;
 }
diff --git a/src/dawguk/GarminConnect.php b/src/dawguk/GarminConnect.php
@@ -114,6 +114,9 @@ private function authorize($strUsername, $strPassword)
             'consumeServiceTicket' => 'false'
         );
         $strResponse = $this->objConnector->get("https://sso.garmin.com/sso/login", $arrParams);
+
+        $strSigninUrl = "https://sso.garmin.com/sso/login?" . http_build_query($arrParams);
+
         if ($this->objConnector->getLastResponseCode() != 200) {
             throw new AuthenticationException(sprintf(
                 "SSO prestart error (code: %d, message: %s)",
@@ -122,15 +125,22 @@ private function authorize($strUsername, $strPassword)
             ));
         }
 
+        preg_match("/name=\"_csrf\" value=\"(.*)\"/", $strResponse, $arrCsrfMatches);
+
+        if (!isset($arrCsrfMatches[1])) {
+            throw new AuthenticationException("Unable to find CSRF input in login form");
+        }
+
         $arrData = array(
             "username" => $strUsername,
             "password" => $strPassword,
             "_eventId" => "submit",
             "embed" => "true",
-            "displayNameRequired" => "false"
+            "displayNameRequired" => "false",
+            "_csrf" => $arrCsrfMatches[1],
         );
 
-        $strResponse = $this->objConnector->post("https://sso.garmin.com/sso/login", $arrParams, $arrData, false);
+        $strResponse = $this->objConnector->post("https://sso.garmin.com/sso/login", $arrParams, $arrData, true, $strSigninUrl);
         preg_match("/ticket=([^\"]+)\"/", $strResponse, $arrMatches);
 
         if (!isset($arrMatches[1])) {
@@ -308,8 +318,8 @@ public function getUsername()
     /**
      * Retrieves weight data
      *
-     * @param date "Y-m-d" $from
-     * @param date "Y-m-d" $until
+     * @param string $strFrom
+     * @param string $strUntil
      * @throws GarminConnect\exceptions\UnexpectedResponseCodeException
      * @throws \Exception
      * @return mixed
@@ -320,8 +330,8 @@ public function getWeightData($strFrom = '2019-01-01', $strUntil = '2099-12-31')
         $intDateUntil = strtotime($strUntil) * 1000;
 
         $arrParams = array(
-            'from' => $strDateFrom,
-            'until' => $strDateUntil
+            'from' => $intDateFrom,
+            'until' => $intDateUntil
         );
 
         $strResponse = $this->objConnector->get(

diff --git a/src/dawguk/GarminConnect/Connector.php b/src/dawguk/GarminConnect/Connector.php
@@ -96,14 +96,15 @@ public function get($strUrl, $arrParams = array(), $bolAllowRedirects = true)
         return $strResponse;
     }
 
-   /**
-    * @param string $strUrl
-    * @param array $arrParams
-    * @param array $arrData
-    * @param bool $bolAllowRedirects
-    * @return mixed
-    */
-    public function post($strUrl, $arrParams = array(), $arrData = array(), $bolAllowRedirects = true)
+    /**
+     * @param string $strUrl
+     * @param array $arrParams
+     * @param array $arrData
+     * @param bool $bolAllowRedirects
+     * @param string|null $strReferer
+     * @return mixed
+     */
+    public function post($strUrl, $arrParams = array(), $arrData = array(), $bolAllowRedirects = true, $strReferer = null)
     {
 
         curl_setopt($this->objCurl, CURLOPT_HEADER, true);
@@ -115,6 +116,9 @@ public function post($strUrl, $arrParams = array(), $arrData = array(), $bolAllo
             curl_setopt($this->objCurl, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
             curl_setopt($this->objCurl, CURLOPT_POSTFIELDS, http_build_query($arrData));
         }
+        if (null !== $strReferer) {
+            curl_setopt($this->objCurl, CURLOPT_REFERER, $strReferer);
+        }
         $strUrl .= '?' . http_build_query($arrParams);
 
         curl_setopt($this->objCurl, CURLOPT_URL, $strUrl);