← All changes | controllers/Auth.php +38 -42 1.0 → 1.8 View file →

		@@ -1,61 +1,63 @@
1	1	<?php
2	2	/*
3	3	Controller Name: Auth
4	4	Controller Description: Authentication add-on controller for the Wordpress JSON API plugin
5		-Controller Author: Matt Berg
6		-Controller Author Twitter: @mattberg
	5	+Controller Author: Matt Berg, Ali Qureshi
	6	+Controller Author Twitter: @parorrey
7	7	*/
8	8
	9	+
9	10	class JSON_API_Auth_Controller {
10		-
	11	+ public function __construct() {
	12	+ global $json_api;
	13	+ // allow only connection over https. because, well, you care about your passwords and sniffing.
	14	+ // turn this sanity-check off if you feel safe inside your localhost or intranet.
	15	+ // send an extra POST parameter: insecure=cool
	16	+ if (empty($_SERVER['HTTPS']) ||
	17	+ (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')) {
	18	+ if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') {
	19	+ $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)");
	20	+ }
	21	+ }
	22	+ $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce');
	23	+ foreach($allowed_from_post as $param) {
	24	+ if (isset($_POST[$param])) {
	25	+ $json_api->query->$param = $_POST[$param];
	26	+ }
	27	+ }
	28	+ }
11	29	public function validate_auth_cookie() {
12	30	global $json_api;
13		-
14	31	if (!$json_api->query->cookie) {
15	32	$json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method.");
16		- }
17		-
18		- $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
19		-
	33	+ }
	34	+ $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
20	35	return array(
21	36	"valid" => $valid
22		- );
	37	+ );
23	38	}
24		-
25	39	public function generate_auth_cookie() {
26	40	global $json_api;
27		-
28		- $nonce_id = $json_api->get_nonce_id('auth', 'generate_auth_cookie');
29		- if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) {
30		- $json_api->error("Your 'nonce' value was incorrect. Use the 'get_nonce' API method.");
31		- }
32		-
33	41	if (!$json_api->query->username) {
34	42	$json_api->error("You must include a 'username' var in your request.");
35	43	}
36		-
37	44	if (!$json_api->query->password) {
38	45	$json_api->error("You must include a 'password' var in your request.");
39		- }
40		-
41		- $user = wp_authenticate($json_api->query->username, $json_api->query->password);
42		- if (is_wp_error($user)) {
43		- $json_api->error("Invalid username and/or password.", 'error', '401');
44		- remove_action('wp_login_failed', $json_api->query->username);
45		- }
46		-
47		- $expiration = time() + apply_filters('auth_cookie_expiration', 1209600, $user->ID, true);
48		-
49		- $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
50		-
51		-
52		- preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
53		-
54		-
55		-
	46	+ }
	47	+ if ($json_api->query->seconds) $seconds = (int) $json_api->query->seconds;
	48	+ else $seconds = 1209600;//14 days
	49	+ $user = wp_authenticate($json_api->query->username, $json_api->query->password);
	50	+ if (is_wp_error($user)) {
	51	+ $json_api->error("Invalid username and/or password.", 'error', '401');
	52	+ remove_action('wp_login_failed', $json_api->query->username);
	53	+ }
	54	+ $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
	55	+ $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
	56	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
56	57	return array(
57	58	"cookie" => $cookie,
	59	+ "cookie_name" => LOGGED_IN_COOKIE,
58	60	"user" => array(
59	61	"id" => $user->ID,
60	62	"username" => $user->user_login,
61	63	"nicename" => $user->user_nicename,
		@@ -71,24 +73,19 @@
71	73	"avatar" => $avatar[1]
72	74	),
73	75	);
74	76	}
75		-
76	77	public function get_currentuserinfo() {
77	78	global $json_api;
78		-
79	79	if (!$json_api->query->cookie) {
80	80	$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method.");
81	81	}
82		-
83	82	$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
84	83	if (!$user_id) {
85	84	$json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method.");
86	85	}
87		-
88	86	$user = get_userdata($user_id);
89		- preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
90		-
	87	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
91	88	return array(
92	89	"user" => array(
93	90	"id" => $user->ID,
94	91	"username" => $user->user_login,
		@@ -104,7 +101,6 @@
104	101	"capabilities" => $user->wp_capabilities,
105	102	"avatar" => $avatar[1]
106	103	)
107	104	);
108		- }
109		-
	105	+ }
110	106	}