| @@ -1,182 +1,63 @@ | ||
| 1 | 1 | <?php |
| 2 | - | |
| 3 | 2 | /* |
| 4 | 3 | Controller Name: Auth |
| 5 | 4 | Controller Description: Authentication add-on controller for the Wordpress JSON API plugin |
| 6 | -Controller Author: Matt Berg | |
| 7 | -Controller Author Twitter: @mattberg | |
| 5 | +Controller Author: Matt Berg, Ali Qureshi | |
| 6 | +Controller Author Twitter: @parorrey | |
| 8 | 7 | */ |
| 9 | 8 | |
| 10 | 9 | |
| 11 | - | |
| 12 | - | |
| 13 | - | |
| 14 | - | |
| 15 | - | |
| 16 | 10 | class JSON_API_Auth_Controller { |
| 17 | - | |
| 18 | - | |
| 19 | - | |
| 20 | - | |
| 21 | - | |
| 22 | - | |
| 23 | - | |
| 11 | + public function __construct() { | |
| 12 | + global $json_api; | |
| 13 | + // allow only connection over https. because, well, you care about your passwords and sniffing. | |
| 14 | + // turn this sanity-check off if you feel safe inside your localhost or intranet. | |
| 15 | + // send an extra POST parameter: insecure=cool | |
| 16 | + if (empty($_SERVER['HTTPS']) || | |
| 17 | + (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')) { | |
| 18 | + if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') { | |
| 19 | + $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)"); | |
| 20 | + } | |
| 21 | + } | |
| 22 | + $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce'); | |
| 23 | + foreach($allowed_from_post as $param) { | |
| 24 | + if (isset($_POST[$param])) { | |
| 25 | + $json_api->query->$param = $_POST[$param]; | |
| 26 | + } | |
| 27 | + } | |
| 28 | + } | |
| 24 | 29 | public function validate_auth_cookie() { |
| 25 | - | |
| 26 | - | |
| 27 | - | |
| 28 | 30 | global $json_api; |
| 29 | - | |
| 30 | - | |
| 31 | - | |
| 32 | - | |
| 33 | - | |
| 34 | - | |
| 35 | - | |
| 36 | 31 | if (!$json_api->query->cookie) { |
| 37 | - | |
| 38 | - | |
| 39 | - | |
| 40 | 32 | $json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method."); |
| 41 | - | |
| 42 | - | |
| 43 | - | |
| 44 | - } | |
| 45 | - | |
| 46 | - | |
| 47 | - | |
| 48 | - | |
| 49 | - | |
| 50 | - | |
| 51 | - | |
| 52 | - $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false; | |
| 53 | - | |
| 54 | - | |
| 55 | - | |
| 56 | - | |
| 57 | - | |
| 58 | - | |
| 59 | - | |
| 33 | + } | |
| 34 | + $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false; | |
| 60 | 35 | return array( |
| 61 | - | |
| 62 | - | |
| 63 | - | |
| 64 | 36 | "valid" => $valid |
| 65 | - | |
| 66 | - | |
| 67 | - | |
| 68 | - ); | |
| 69 | - | |
| 70 | - | |
| 71 | - | |
| 37 | + ); | |
| 72 | 38 | } |
| 73 | - | |
| 74 | - | |
| 75 | - | |
| 76 | - | |
| 77 | - | |
| 78 | - | |
| 79 | - | |
| 80 | 39 | public function generate_auth_cookie() { |
| 81 | - | |
| 82 | - | |
| 83 | - | |
| 84 | 40 | global $json_api; |
| 85 | - | |
| 86 | - | |
| 87 | - | |
| 88 | - | |
| 89 | - | |
| 90 | - | |
| 91 | - | |
| 92 | - $nonce_id = $json_api->get_nonce_id('auth', 'generate_auth_cookie'); | |
| 93 | - | |
| 94 | - | |
| 95 | - | |
| 96 | - if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) { | |
| 97 | - | |
| 98 | - | |
| 99 | - | |
| 100 | - $json_api->error("Your 'nonce' value was incorrect. Use the 'get_nonce' API method."); | |
| 101 | - | |
| 102 | - | |
| 103 | - | |
| 104 | - } | |
| 105 | - | |
| 106 | - | |
| 107 | - | |
| 108 | - | |
| 109 | - | |
| 110 | - | |
| 111 | - | |
| 112 | 41 | if (!$json_api->query->username) { |
| 113 | - | |
| 114 | - | |
| 115 | - | |
| 116 | 42 | $json_api->error("You must include a 'username' var in your request."); |
| 117 | - | |
| 118 | - | |
| 119 | - | |
| 120 | 43 | } |
| 121 | - | |
| 122 | - | |
| 123 | - | |
| 124 | - | |
| 125 | - | |
| 126 | - | |
| 127 | - | |
| 128 | 44 | if (!$json_api->query->password) { |
| 129 | - | |
| 130 | - | |
| 131 | - | |
| 132 | 45 | $json_api->error("You must include a 'password' var in your request."); |
| 133 | - | |
| 134 | - | |
| 135 | - | |
| 136 | - } | |
| 137 | - | |
| 138 | - | |
| 139 | - | |
| 140 | - | |
| 141 | - | |
| 142 | - | |
| 143 | - | |
| 144 | - $user = wp_authenticate($json_api->query->username, $json_api->query->password); | |
| 145 | - | |
| 146 | - | |
| 147 | - | |
| 148 | - if (is_wp_error($user)) { | |
| 149 | - | |
| 150 | - | |
| 151 | - | |
| 152 | - $json_api->error("Invalid username and/or password.", 'error', '401'); | |
| 153 | - | |
| 154 | - | |
| 155 | - | |
| 156 | - remove_action('wp_login_failed', $json_api->query->username); | |
| 157 | - | |
| 158 | - | |
| 159 | - | |
| 160 | - } | |
| 161 | - | |
| 162 | - | |
| 163 | - | |
| 164 | - | |
| 165 | - | |
| 166 | - | |
| 167 | - | |
| 168 | - $expiration = time() + apply_filters('auth_cookie_expiration', 1209600, $user->ID, true); | |
| 169 | - | |
| 170 | - | |
| 171 | - $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in'); | |
| 172 | - | |
| 173 | - | |
| 174 | - preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 175 | - | |
| 176 | - | |
| 46 | + } | |
| 47 | + if ($json_api->query->seconds) $seconds = (int) $json_api->query->seconds; | |
| 48 | + else $seconds = 1209600;//14 days | |
| 49 | + $user = wp_authenticate($json_api->query->username, $json_api->query->password); | |
| 50 | + if (is_wp_error($user)) { | |
| 51 | + $json_api->error("Invalid username and/or password.", 'error', '401'); | |
| 52 | + remove_action('wp_login_failed', $json_api->query->username); | |
| 53 | + } | |
| 54 | + $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true); | |
| 55 | + $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in'); | |
| 56 | + preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 177 | 57 | return array( |
| 178 | 58 | "cookie" => $cookie, |
| 59 | + "cookie_name" => LOGGED_IN_COOKIE, | |
| 179 | 60 | "user" => array( |
| 180 | 61 | "id" => $user->ID, |
| 181 | 62 | "username" => $user->user_login, |
| 182 | 63 | "nicename" => $user->user_nicename, |
| @@ -189,64 +70,22 @@ | ||
| 189 | 70 | "nickname" => $user->nickname, |
| 190 | 71 | "description" => $user->user_description, |
| 191 | 72 | "capabilities" => $user->wp_capabilities, |
| 192 | 73 | "avatar" => $avatar[1] |
| 193 | - | |
| 194 | 74 | ), |
| 195 | 75 | ); |
| 196 | 76 | } |
| 197 | - | |
| 198 | - | |
| 199 | - | |
| 200 | -public function clear_auth_cookie() { | |
| 201 | - global $json_api; | |
| 202 | - if (!$json_api->query->cookie) { | |
| 203 | - | |
| 204 | - $json_api->error("You must include a valid 'cookie' to clear it."); | |
| 205 | - } | |
| 206 | - | |
| 207 | - | |
| 208 | - | |
| 209 | - $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); | |
| 210 | - | |
| 211 | - | |
| 212 | - if (!$user_id) { | |
| 213 | - $json_api->error("Invalid authentication cookie. Provide a valid cookie to clear."); | |
| 214 | - } | |
| 215 | - | |
| 216 | - | |
| 217 | - $expiration = time() + apply_filters('auth_cookie_expiration', -1209600, $user_id, true); | |
| 218 | - | |
| 219 | - $cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in'); | |
| 220 | - | |
| 221 | - $valid = wp_validate_auth_cookie($cookie, 'logged_in') ? true : false; | |
| 222 | - | |
| 223 | - | |
| 224 | - return array( | |
| 225 | - "valid" => $valid | |
| 226 | - ); | |
| 227 | - | |
| 228 | - } | |
| 229 | - | |
| 230 | - | |
| 231 | - | |
| 232 | 77 | public function get_currentuserinfo() { |
| 233 | 78 | global $json_api; |
| 234 | - | |
| 235 | 79 | if (!$json_api->query->cookie) { |
| 236 | 80 | $json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method."); |
| 237 | - | |
| 238 | - } | |
| 239 | - | |
| 81 | + } | |
| 240 | 82 | $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 241 | - | |
| 242 | 83 | if (!$user_id) { |
| 243 | 84 | $json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method."); |
| 244 | 85 | } |
| 245 | - | |
| 246 | 86 | $user = get_userdata($user_id); |
| 247 | - preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 248 | - | |
| 87 | + preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 249 | 88 | return array( |
| 250 | 89 | "user" => array( |
| 251 | 90 | "id" => $user->ID, |
| 252 | 91 | "username" => $user->user_login, |
| @@ -259,13 +98,9 @@ | ||
| 259 | 98 | "lastname" => $user->last_name, |
| 260 | 99 | "nickname" => $user->nickname, |
| 261 | 100 | "description" => $user->user_description, |
| 262 | 101 | "capabilities" => $user->wp_capabilities, |
| 263 | - | |
| 264 | 102 | "avatar" => $avatar[1] |
| 265 | - | |
| 266 | 103 | ) |
| 267 | - | |
| 268 | 104 | ); |
| 269 | - | |
| 270 | - } | |
| 105 | + } | |
| 271 | 106 | } |
