← All changes | controllers/Auth.php +150 -119 3.0.0 → 1.7 View file →

		@@ -1,120 +1,151 @@
1		-<?php
2		-/*
3		-Controller Name: Auth
4		-Controller Description: Authentication add-on controller for the Wordpress JSON API plugin
5		-Controller Author: Matt Berg, Ali Qureshi
6		-Controller Author Twitter: @parorrey
7		-*/
8		-
9		-
10		-class JSON_API_Auth_Controller
11		-{
12		- public function __construct()
13		- {
14		- global $json_api;
15		- // allow only connection over https. because, well, you care about your passwords and sniffing.
16		- // turn this sanity-check off if you feel safe inside your localhost or intranet.
17		- // send an extra POST parameter: insecure=cool
18		- if (
19		- empty($_SERVER['HTTPS']) ||
20		- (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')
21		- ) {
22		- if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') {
23		- $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)");
24		- }
25		- }
26		- $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce');
27		- foreach ($allowed_from_post as $param) {
28		- if (isset($_POST[$param])) {
29		- $json_api->query->$param = $_POST[$param];
30		- }
31		- }
32		- }
33		- public function validate_auth_cookie()
34		- {
35		- global $json_api;
36		- if (!$json_api->query->cookie) {
37		- $json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method.");
38		- }
39		- $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
40		- return array(
41		- "valid" => $valid
42		- );
43		- }
44		- public function generate_auth_cookie()
45		- {
46		- global $json_api;
47		- if (!$json_api->query->username) {
48		- $json_api->error("You must include a 'username' var in your request.");
49		- }
50		- if (!$json_api->query->password) {
51		- $json_api->error("You must include a 'password' var in your request.");
52		- }
53		- if ($json_api->query->seconds)
54		- $seconds = (int) $json_api->query->seconds;
55		- else
56		- $seconds = 1209600; //14 days
57		- $user = wp_authenticate($json_api->query->username, $json_api->query->password);
58		- if (is_wp_error($user)) {
59		- remove_action('wp_login_failed', $json_api->query->username);
60		- $json_api->error("Invalid username and/or password.", 'error', '401');
61		-
62		- }
63		- $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
64		- $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
65		- preg_match('|src="(.+?)"|', get_avatar($user->ID, 32), $avatar);
66		- $avatar_icon = isset($avatar[1]) ? $avatar[1] : NULL;
67		-
68		- return array(
69		- "cookie" => $cookie,
70		- "cookie_name" => LOGGED_IN_COOKIE,
71		- "user" => array(
72		- "id" => $user->ID,
73		- "username" => $user->user_login,
74		- "nicename" => $user->user_nicename,
75		- "email" => $user->user_email,
76		- "url" => $user->user_url,
77		- "registered" => $user->user_registered,
78		- "displayname" => $user->display_name,
79		- "firstname" => $user->user_firstname,
80		- "lastname" => $user->last_name,
81		- "nickname" => $user->nickname,
82		- "description" => $user->user_description,
83		- "capabilities" => $user->wp_capabilities,
84		- "avatar" => $avatar_icon
85		- ),
86		- );
87		- }
88		- public function get_currentuserinfo()
89		- {
90		- global $json_api;
91		- if (!$json_api->query->cookie) {
92		- $json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method.");
93		- }
94		- $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
95		- if (!$user_id) {
96		- $json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method.");
97		- }
98		- $user = get_userdata($user_id);
99		- preg_match('|src="(.+?)"|', get_avatar($user->ID, 32), $avatar);
100		- $avatar_icon = isset($avatar[1]) ? $avatar[1] : NULL;
101		-
102		- return array(
103		- "user" => array(
104		- "id" => $user->ID,
105		- "username" => $user->user_login,
106		- "nicename" => $user->user_nicename,
107		- "email" => $user->user_email,
108		- "url" => $user->user_url,
109		- "registered" => $user->user_registered,
110		- "displayname" => $user->display_name,
111		- "firstname" => $user->user_firstname,
112		- "lastname" => $user->last_name,
113		- "nickname" => $user->nickname,
114		- "description" => $user->user_description,
115		- "capabilities" => $user->wp_capabilities,
116		- "avatar" => $avatar_icon
117		- )
118		- );
119		- }
	1	+<?php
	2	+
	3	+/*
	4	+Controller Name: Auth
	5	+Controller Description: Authentication add-on controller for the Wordpress JSON API plugin
	6	+Controller Author: Matt Berg, Ali Qureshi
	7	+Controller Author Twitter: @parorrey
	8	+*/
	9	+
	10	+
	11	+
	12	+
	13	+
	14	+
	15	+
	16	+class JSON_API_Auth_Controller {
	17	+
	18	+
	19	+ public function validate_auth_cookie() {
	20	+
	21	+ global $json_api;
	22	+
	23	+ if (!$json_api->query->cookie) {
	24	+
	25	+ $json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method.");
	26	+
	27	+ }
	28	+
	29	+ $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
	30	+
	31	+ return array(
	32	+
	33	+ "valid" => $valid
	34	+
	35	+ );
	36	+
	37	+
	38	+ }
	39	+
	40	+ public function generate_auth_cookie() {
	41	+
	42	+ global $json_api;
	43	+
	44	+ /*
	45	+ $nonce_id = $json_api->get_nonce_id('auth', 'generate_auth_cookie');
	46	+
	47	+ if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) {
	48	+
	49	+ $json_api->error("Your 'nonce' value was incorrect. Use the 'get_nonce' API method.");
	50	+ }*/
	51	+
	52	+
	53	+ if (!$json_api->query->username) {
	54	+
	55	+ $json_api->error("You must include a 'username' var in your request.");
	56	+
	57	+ }
	58	+
	59	+
	60	+ if (!$json_api->query->password) {
	61	+
	62	+ $json_api->error("You must include a 'password' var in your request.");
	63	+
	64	+ }
	65	+
	66	+ if ($json_api->query->seconds) $seconds = (int) $json_api->query->seconds;
	67	+
	68	+ else $seconds = 1209600;//14 days
	69	+
	70	+
	71	+
	72	+ $user = wp_authenticate($json_api->query->username, $json_api->query->password);
	73	+
	74	+ if (is_wp_error($user)) {
	75	+
	76	+ $json_api->error("Invalid username and/or password.", 'error', '401');
	77	+
	78	+ remove_action('wp_login_failed', $json_api->query->username);
	79	+
	80	+ }
	81	+
	82	+
	83	+ $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
	84	+
	85	+ $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
	86	+
	87	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
	88	+
	89	+ return array(
	90	+ "cookie" => $cookie,
	91	+ "cookie_name" => LOGGED_IN_COOKIE,
	92	+ "user" => array(
	93	+ "id" => $user->ID,
	94	+ "username" => $user->user_login,
	95	+ "nicename" => $user->user_nicename,
	96	+ "email" => $user->user_email,
	97	+ "url" => $user->user_url,
	98	+ "registered" => $user->user_registered,
	99	+ "displayname" => $user->display_name,
	100	+ "firstname" => $user->user_firstname,
	101	+ "lastname" => $user->last_name,
	102	+ "nickname" => $user->nickname,
	103	+ "description" => $user->user_description,
	104	+ "capabilities" => $user->wp_capabilities,
	105	+ "avatar" => $avatar[1]
	106	+
	107	+ ),
	108	+ );
	109	+ }
	110	+
	111	+
	112	+ public function get_currentuserinfo() {
	113	+ global $json_api;
	114	+
	115	+ if (!$json_api->query->cookie) {
	116	+ $json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method.");
	117	+
	118	+ }
	119	+
	120	+ $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
	121	+
	122	+ if (!$user_id) {
	123	+ $json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method.");
	124	+ }
	125	+
	126	+ $user = get_userdata($user_id);
	127	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
	128	+
	129	+ return array(
	130	+ "user" => array(
	131	+ "id" => $user->ID,
	132	+ "username" => $user->user_login,
	133	+ "nicename" => $user->user_nicename,
	134	+ "email" => $user->user_email,
	135	+ "url" => $user->user_url,
	136	+ "registered" => $user->user_registered,
	137	+ "displayname" => $user->display_name,
	138	+ "firstname" => $user->user_firstname,
	139	+ "lastname" => $user->last_name,
	140	+ "nickname" => $user->nickname,
	141	+ "description" => $user->user_description,
	142	+ "capabilities" => $user->wp_capabilities,
	143	+
	144	+ "avatar" => $avatar[1]
	145	+
	146	+ )
	147	+
	148	+ );
	149	+
	150	+ }
120	151	}