← All changes | controllers/Auth.php +78 -33 2.3.0 → 1.6 View file →

		@@ -1,5 +1,6 @@
1	1	<?php
	2	+
2	3	/*
3	4	Controller Name: Auth
4	5	Controller Description: Authentication add-on controller for the Wordpress JSON API plugin
5	6	Controller Author: Matt Berg, Ali Qureshi
		@@ -6,55 +7,86 @@
6	7	Controller Author Twitter: @parorrey
7	8	*/
8	9
9	10
	11	+
	12	+
	13	+
	14	+
	15	+
10	16	class JSON_API_Auth_Controller {
11		- public function __construct() {
12		- global $json_api;
13		- // allow only connection over https. because, well, you care about your passwords and sniffing.
14		- // turn this sanity-check off if you feel safe inside your localhost or intranet.
15		- // send an extra POST parameter: insecure=cool
16		- if (empty($_SERVER['HTTPS']) ||
17		- (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')) {
18		- if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') {
19		- $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)");
20		- }
21		- }
22		- $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce');
23		- foreach($allowed_from_post as $param) {
24		- if (isset($_POST[$param])) {
25		- $json_api->query->$param = $_POST[$param];
26		- }
27		- }
28		- }
	17	+
	18	+
29	19	public function validate_auth_cookie() {
	20	+
30	21	global $json_api;
	22	+
31	23	if (!$json_api->query->cookie) {
	24	+
32	25	$json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method.");
33		- }
34		- $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
	26	+
	27	+ }
	28	+
	29	+ $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
	30	+
35	31	return array(
	32	+
36	33	"valid" => $valid
37		- );
	34	+
	35	+ );
	36	+
	37	+
38	38	}
	39	+
39	40	public function generate_auth_cookie() {
	41	+
40	42	global $json_api;
	43	+
	44	+ /*
	45	+ $nonce_id = $json_api->get_nonce_id('auth', 'generate_auth_cookie');
	46	+
	47	+ if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) {
	48	+
	49	+ $json_api->error("Your 'nonce' value was incorrect. Use the 'get_nonce' API method.");
	50	+ }*/
	51	+
	52	+
41	53	if (!$json_api->query->username) {
	54	+
42	55	$json_api->error("You must include a 'username' var in your request.");
	56	+
43	57	}
	58	+
	59	+
44	60	if (!$json_api->query->password) {
	61	+
45	62	$json_api->error("You must include a 'password' var in your request.");
46		- }
	63	+
	64	+ }
	65	+
47	66	if ($json_api->query->seconds) $seconds = (int) $json_api->query->seconds;
	67	+
48	68	else $seconds = 1209600;//14 days
49		- $user = wp_authenticate($json_api->query->username, $json_api->query->password);
50		- if (is_wp_error($user)) {
51		- $json_api->error("Invalid username and/or password.", 'error', '401');
52		- remove_action('wp_login_failed', $json_api->query->username);
53		- }
54		- $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
55		- $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
56		- preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
	69	+
	70	+
	71	+
	72	+ $user = wp_authenticate($json_api->query->username, $json_api->query->password);
	73	+
	74	+ if (is_wp_error($user)) {
	75	+
	76	+ $json_api->error("Invalid username and/or password.", 'error', '401');
	77	+
	78	+ remove_action('wp_login_failed', $json_api->query->username);
	79	+
	80	+ }
	81	+
	82	+
	83	+ $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
	84	+
	85	+ $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
	86	+
	87	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
	88	+
57	89	return array(
58	90	"cookie" => $cookie,
59	91	"cookie_name" => LOGGED_IN_COOKIE,
60	92	"user" => array(
		@@ -70,22 +102,31 @@
70	102	"nickname" => $user->nickname,
71	103	"description" => $user->user_description,
72	104	"capabilities" => $user->wp_capabilities,
73	105	"avatar" => $avatar[1]
	106	+
74	107	),
75	108	);
76	109	}
	110	+
	111	+
77	112	public function get_currentuserinfo() {
78	113	global $json_api;
	114	+
79	115	if (!$json_api->query->cookie) {
80	116	$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method.");
81		- }
	117	+
	118	+ }
	119	+
82	120	$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
	121	+
83	122	if (!$user_id) {
84	123	$json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method.");
85	124	}
	125	+
86	126	$user = get_userdata($user_id);
87		- preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
	127	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
	128	+
88	129	return array(
89	130	"user" => array(
90	131	"id" => $user->ID,
91	132	"username" => $user->user_login,
		@@ -98,9 +139,13 @@
98	139	"lastname" => $user->last_name,
99	140	"nickname" => $user->nickname,
100	141	"description" => $user->user_description,
101	142	"capabilities" => $user->wp_capabilities,
	143	+
102	144	"avatar" => $avatar[1]
	145	+
103	146	)
	147	+
104	148	);
105		- }
	149	+
	150	+ }
106	151	}