| @@ -1,250 +1,106 @@ | ||
| 1 | -<?php | |
| 2 | - | |
| 3 | -/* | |
| 4 | - | |
| 5 | -Controller Name: Auth | |
| 6 | - | |
| 7 | -Controller Description: Authentication add-on controller for the Wordpress JSON API plugin | |
| 8 | - | |
| 9 | -Controller Author: Matt Berg | |
| 10 | - | |
| 11 | -Controller Author Twitter: @mattberg | |
| 12 | - | |
| 13 | -*/ | |
| 14 | - | |
| 15 | - | |
| 16 | - | |
| 17 | -class JSON_API_Auth_Controller { | |
| 18 | - | |
| 19 | - | |
| 20 | - | |
| 21 | - public function validate_auth_cookie() { | |
| 22 | - | |
| 23 | - global $json_api; | |
| 24 | - | |
| 25 | - | |
| 26 | - | |
| 27 | - if (!$json_api->query->cookie) { | |
| 28 | - | |
| 29 | - $json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method."); | |
| 30 | - | |
| 31 | - } | |
| 32 | - | |
| 33 | - | |
| 34 | - | |
| 35 | - $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false; | |
| 36 | - | |
| 37 | - | |
| 38 | - | |
| 39 | - return array( | |
| 40 | - | |
| 41 | - "valid" => $valid | |
| 42 | - | |
| 43 | - ); | |
| 44 | - | |
| 45 | - } | |
| 46 | - | |
| 47 | - | |
| 48 | - | |
| 49 | - public function generate_auth_cookie() { | |
| 50 | - | |
| 51 | - global $json_api; | |
| 52 | - | |
| 53 | - | |
| 54 | - | |
| 55 | - $nonce_id = $json_api->get_nonce_id('auth', 'generate_auth_cookie'); | |
| 56 | - | |
| 57 | - if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) { | |
| 58 | - | |
| 59 | - $json_api->error("Your 'nonce' value was incorrect. Use the 'get_nonce' API method."); | |
| 60 | - | |
| 61 | - } | |
| 62 | - | |
| 63 | - | |
| 64 | - | |
| 65 | - if (!$json_api->query->username) { | |
| 66 | - | |
| 67 | - $json_api->error("You must include a 'username' var in your request."); | |
| 68 | - | |
| 69 | - } | |
| 70 | - | |
| 71 | - | |
| 72 | - | |
| 73 | - if (!$json_api->query->password) { | |
| 74 | - | |
| 75 | - $json_api->error("You must include a 'password' var in your request."); | |
| 76 | - | |
| 77 | - } | |
| 78 | - | |
| 79 | - | |
| 80 | - | |
| 81 | - $user = wp_authenticate($json_api->query->username, $json_api->query->password); | |
| 82 | - | |
| 83 | - if (is_wp_error($user)) { | |
| 84 | - | |
| 85 | - $json_api->error("Invalid username and/or password.", 'error', '401'); | |
| 86 | - | |
| 87 | - remove_action('wp_login_failed', $json_api->query->username); | |
| 88 | - | |
| 89 | - } | |
| 90 | - | |
| 91 | - | |
| 92 | - | |
| 93 | - $expiration = time() + apply_filters('auth_cookie_expiration', -1209600, $user->ID, true); | |
| 94 | - | |
| 95 | - | |
| 96 | - | |
| 97 | - $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in'); | |
| 98 | - | |
| 99 | - | |
| 100 | - | |
| 101 | - | |
| 102 | - | |
| 103 | - preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 104 | - | |
| 105 | - | |
| 106 | - | |
| 107 | - | |
| 108 | - | |
| 109 | - | |
| 110 | - | |
| 111 | - return array( | |
| 112 | - | |
| 113 | - "cookie" => $cookie, | |
| 114 | - | |
| 115 | - "user" => array( | |
| 116 | - | |
| 117 | - "id" => $user->ID, | |
| 118 | - | |
| 119 | - "username" => $user->user_login, | |
| 120 | - | |
| 121 | - "nicename" => $user->user_nicename, | |
| 122 | - | |
| 123 | - "email" => $user->user_email, | |
| 124 | - | |
| 125 | - "url" => $user->user_url, | |
| 126 | - | |
| 127 | - "registered" => $user->user_registered, | |
| 128 | - | |
| 129 | - "displayname" => $user->display_name, | |
| 130 | - | |
| 131 | - "firstname" => $user->user_firstname, | |
| 132 | - | |
| 133 | - "lastname" => $user->last_name, | |
| 134 | - | |
| 135 | - "nickname" => $user->nickname, | |
| 136 | - | |
| 137 | - "description" => $user->user_description, | |
| 138 | - | |
| 139 | - "capabilities" => $user->wp_capabilities, | |
| 140 | - | |
| 141 | - "avatar" => $avatar[1] | |
| 142 | - | |
| 143 | - ), | |
| 144 | - | |
| 145 | - ); | |
| 146 | - | |
| 147 | - } | |
| 148 | - | |
| 149 | - | |
| 150 | -public function clear_auth_cookie() { | |
| 151 | - | |
| 152 | - global $json_api; | |
| 153 | - | |
| 154 | - if (!$json_api->query->cookie) { | |
| 155 | - | |
| 156 | - $json_api->error("You must include a valid 'cookie' to clear it."); | |
| 157 | - | |
| 158 | - } | |
| 159 | - | |
| 160 | - $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); | |
| 161 | - | |
| 162 | - if (!$user_id) { | |
| 163 | - | |
| 164 | - $json_api->error("Invalid authentication cookie. Provide a valid cookie to clear."); | |
| 165 | - | |
| 166 | - } | |
| 167 | - | |
| 168 | - $expiration = time() + apply_filters('auth_cookie_expiration', -1209600, $user_id, true); | |
| 169 | - | |
| 170 | - $cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in'); | |
| 171 | - | |
| 172 | - $valid = wp_validate_auth_cookie($cookie, 'logged_in') ? true : false; | |
| 173 | - | |
| 174 | - return array( | |
| 175 | - | |
| 176 | - "valid" => $valid | |
| 177 | - | |
| 178 | - ); | |
| 179 | - | |
| 180 | - } | |
| 181 | - | |
| 182 | - public function get_currentuserinfo() { | |
| 183 | - | |
| 184 | - global $json_api; | |
| 185 | - | |
| 186 | - | |
| 187 | - | |
| 188 | - if (!$json_api->query->cookie) { | |
| 189 | - | |
| 190 | - $json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method."); | |
| 191 | - | |
| 192 | - } | |
| 193 | - | |
| 194 | - | |
| 195 | - | |
| 196 | - $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); | |
| 197 | - | |
| 198 | - if (!$user_id) { | |
| 199 | - | |
| 200 | - $json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method."); | |
| 201 | - | |
| 202 | - } | |
| 203 | - | |
| 204 | - | |
| 205 | - | |
| 206 | - $user = get_userdata($user_id); | |
| 207 | - | |
| 208 | - preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 209 | - | |
| 210 | - | |
| 211 | - | |
| 212 | - return array( | |
| 213 | - | |
| 214 | - "user" => array( | |
| 215 | - | |
| 216 | - "id" => $user->ID, | |
| 217 | - | |
| 218 | - "username" => $user->user_login, | |
| 219 | - | |
| 220 | - "nicename" => $user->user_nicename, | |
| 221 | - | |
| 222 | - "email" => $user->user_email, | |
| 223 | - | |
| 224 | - "url" => $user->user_url, | |
| 225 | - | |
| 226 | - "registered" => $user->user_registered, | |
| 227 | - | |
| 228 | - "displayname" => $user->display_name, | |
| 229 | - | |
| 230 | - "firstname" => $user->user_firstname, | |
| 231 | - | |
| 232 | - "lastname" => $user->last_name, | |
| 233 | - | |
| 234 | - "nickname" => $user->nickname, | |
| 235 | - | |
| 236 | - "description" => $user->user_description, | |
| 237 | - | |
| 238 | - "capabilities" => $user->wp_capabilities, | |
| 239 | - | |
| 240 | - "avatar" => $avatar[1] | |
| 241 | - | |
| 242 | - ) | |
| 243 | - | |
| 244 | - ); | |
| 245 | - | |
| 246 | - } | |
| 247 | - | |
| 248 | - | |
| 249 | - | |
| 1 | +<?php | |
| 2 | +/* | |
| 3 | +Controller Name: Auth | |
| 4 | +Controller Description: Authentication add-on controller for the Wordpress JSON API plugin | |
| 5 | +Controller Author: Matt Berg, Ali Qureshi | |
| 6 | +Controller Author Twitter: @parorrey | |
| 7 | +*/ | |
| 8 | + | |
| 9 | + | |
| 10 | +class JSON_API_Auth_Controller { | |
| 11 | + public function __construct() { | |
| 12 | + global $json_api; | |
| 13 | + // allow only connection over https. because, well, you care about your passwords and sniffing. | |
| 14 | + // turn this sanity-check off if you feel safe inside your localhost or intranet. | |
| 15 | + // send an extra POST parameter: insecure=cool | |
| 16 | + if (empty($_SERVER['HTTPS']) || | |
| 17 | + (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')) { | |
| 18 | + if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') { | |
| 19 | + $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)"); | |
| 20 | + } | |
| 21 | + } | |
| 22 | + $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce'); | |
| 23 | + foreach($allowed_from_post as $param) { | |
| 24 | + if (isset($_POST[$param])) { | |
| 25 | + $json_api->query->$param = $_POST[$param]; | |
| 26 | + } | |
| 27 | + } | |
| 28 | + } | |
| 29 | + public function validate_auth_cookie() { | |
| 30 | + global $json_api; | |
| 31 | + if (!$json_api->query->cookie) { | |
| 32 | + $json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method."); | |
| 33 | + } | |
| 34 | + $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false; | |
| 35 | + return array( | |
| 36 | + "valid" => $valid | |
| 37 | + ); | |
| 38 | + } | |
| 39 | + public function generate_auth_cookie() { | |
| 40 | + global $json_api; | |
| 41 | + if (!$json_api->query->username) { | |
| 42 | + $json_api->error("You must include a 'username' var in your request."); | |
| 43 | + } | |
| 44 | + if (!$json_api->query->password) { | |
| 45 | + $json_api->error("You must include a 'password' var in your request."); | |
| 46 | + } | |
| 47 | + if ($json_api->query->seconds) $seconds = (int) $json_api->query->seconds; | |
| 48 | + else $seconds = 1209600;//14 days | |
| 49 | + $user = wp_authenticate($json_api->query->username, $json_api->query->password); | |
| 50 | + if (is_wp_error($user)) { | |
| 51 | + $json_api->error("Invalid username and/or password.", 'error', '401'); | |
| 52 | + remove_action('wp_login_failed', $json_api->query->username); | |
| 53 | + } | |
| 54 | + $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true); | |
| 55 | + $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in'); | |
| 56 | + preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 57 | + return array( | |
| 58 | + "cookie" => $cookie, | |
| 59 | + "cookie_name" => LOGGED_IN_COOKIE, | |
| 60 | + "user" => array( | |
| 61 | + "id" => $user->ID, | |
| 62 | + "username" => $user->user_login, | |
| 63 | + "nicename" => $user->user_nicename, | |
| 64 | + "email" => $user->user_email, | |
| 65 | + "url" => $user->user_url, | |
| 66 | + "registered" => $user->user_registered, | |
| 67 | + "displayname" => $user->display_name, | |
| 68 | + "firstname" => $user->user_firstname, | |
| 69 | + "lastname" => $user->last_name, | |
| 70 | + "nickname" => $user->nickname, | |
| 71 | + "description" => $user->user_description, | |
| 72 | + "capabilities" => $user->wp_capabilities, | |
| 73 | + "avatar" => $avatar[1] | |
| 74 | + ), | |
| 75 | + ); | |
| 76 | + } | |
| 77 | + public function get_currentuserinfo() { | |
| 78 | + global $json_api; | |
| 79 | + if (!$json_api->query->cookie) { | |
| 80 | + $json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method."); | |
| 81 | + } | |
| 82 | + $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); | |
| 83 | + if (!$user_id) { | |
| 84 | + $json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method."); | |
| 85 | + } | |
| 86 | + $user = get_userdata($user_id); | |
| 87 | + preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 88 | + return array( | |
| 89 | + "user" => array( | |
| 90 | + "id" => $user->ID, | |
| 91 | + "username" => $user->user_login, | |
| 92 | + "nicename" => $user->user_nicename, | |
| 93 | + "email" => $user->user_email, | |
| 94 | + "url" => $user->user_url, | |
| 95 | + "registered" => $user->user_registered, | |
| 96 | + "displayname" => $user->display_name, | |
| 97 | + "firstname" => $user->user_firstname, | |
| 98 | + "lastname" => $user->last_name, | |
| 99 | + "nickname" => $user->nickname, | |
| 100 | + "description" => $user->user_description, | |
| 101 | + "capabilities" => $user->wp_capabilities, | |
| 102 | + "avatar" => $avatar[1] | |
| 103 | + ) | |
| 104 | + ); | |
| 105 | + } | |
| 250 | 106 | } |
