← All changes | controllers/Auth.php +34 -112 1.5 → 1.8 View file →

		@@ -1,6 +1,5 @@
1	1	<?php
2		-
3	2	/*
4	3	Controller Name: Auth
5	4	Controller Description: Authentication add-on controller for the Wordpress JSON API plugin
6	5	Controller Author: Matt Berg, Ali Qureshi
		@@ -7,89 +6,58 @@
7	6	Controller Author Twitter: @parorrey
8	7	*/
9	8
10	9
11		-
12		-
13		-
14		-
15		-
16	10	class JSON_API_Auth_Controller {
17		-
18		-
	11	+ public function __construct() {
	12	+ global $json_api;
	13	+ // allow only connection over https. because, well, you care about your passwords and sniffing.
	14	+ // turn this sanity-check off if you feel safe inside your localhost or intranet.
	15	+ // send an extra POST parameter: insecure=cool
	16	+ if (empty($_SERVER['HTTPS']) ||
	17	+ (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')) {
	18	+ if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') {
	19	+ $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)");
	20	+ }
	21	+ }
	22	+ $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce');
	23	+ foreach($allowed_from_post as $param) {
	24	+ if (isset($_POST[$param])) {
	25	+ $json_api->query->$param = $_POST[$param];
	26	+ }
	27	+ }
	28	+ }
19	29	public function validate_auth_cookie() {
20		-
21	30	global $json_api;
22		-
23	31	if (!$json_api->query->cookie) {
24		-
25	32	$json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method.");
26		-
27		- }
28		-
29		- $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
30		-
	33	+ }
	34	+ $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
31	35	return array(
32		-
33	36	"valid" => $valid
34		-
35		- );
36		-
37		-
	37	+ );
38	38	}
39		-
40	39	public function generate_auth_cookie() {
41		-
42	40	global $json_api;
43		-
44		- $nonce_id = $json_api->get_nonce_id('auth', 'generate_auth_cookie');
45		-
46		-
47		-
48		- if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) {
49		-
50		- $json_api->error("Your 'nonce' value was incorrect. Use the 'get_nonce' API method.");
51		- }
52		-
53		-
54	41	if (!$json_api->query->username) {
55		-
56	42	$json_api->error("You must include a 'username' var in your request.");
57		-
58	43	}
59		-
60		-
61	44	if (!$json_api->query->password) {
62		-
63	45	$json_api->error("You must include a 'password' var in your request.");
64		-
65		- }
66		-
	46	+ }
67	47	if ($json_api->query->seconds) $seconds = (int) $json_api->query->seconds;
68		-
69	48	else $seconds = 1209600;//14 days
70		-
71		-
72		-
73		- $user = wp_authenticate($json_api->query->username, $json_api->query->password);
74		-
75		- if (is_wp_error($user)) {
76		-
77		- $json_api->error("Invalid username and/or password.", 'error', '401');
78		-
79		- remove_action('wp_login_failed', $json_api->query->username);
80		-
81		- }
82		-
83		-
84		- $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
85		-
86		- $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
87		-
88		- preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
89		-
	49	+ $user = wp_authenticate($json_api->query->username, $json_api->query->password);
	50	+ if (is_wp_error($user)) {
	51	+ $json_api->error("Invalid username and/or password.", 'error', '401');
	52	+ remove_action('wp_login_failed', $json_api->query->username);
	53	+ }
	54	+ $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
	55	+ $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
	56	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
90	57	return array(
91	58	"cookie" => $cookie,
	59	+ "cookie_name" => LOGGED_IN_COOKIE,
92	60	"user" => array(
93	61	"id" => $user->ID,
94	62	"username" => $user->user_login,
95	63	"nicename" => $user->user_nicename,
		@@ -102,64 +70,22 @@
102	70	"nickname" => $user->nickname,
103	71	"description" => $user->user_description,
104	72	"capabilities" => $user->wp_capabilities,
105	73	"avatar" => $avatar[1]
106		-
107	74	),
108	75	);
109	76	}
110		-
111		-
112		-/*
113		-public function clear_auth_cookie() {
114		- global $json_api;
115		- if (!$json_api->query->cookie) {
116		-
117		- $json_api->error("You must include a valid 'cookie' to clear it.");
118		- }
119		-
120		-
121		-
122		- $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
123		-
124		-
125		- if (!$user_id) {
126		- $json_api->error("Invalid authentication cookie. Provide a valid cookie to clear.");
127		- }
128		-
129		-
130		- $expiration = time() + apply_filters('auth_cookie_expiration', -1209600, $user_id, true);
131		-
132		- $cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');
133		-
134		- $valid = wp_validate_auth_cookie($cookie, 'logged_in') ? true : false;
135		-
136		-
137		- return array(
138		- "valid" => $valid
139		- );
140		-
141		- }
142		-*/
143		-
144		-
145	77	public function get_currentuserinfo() {
146	78	global $json_api;
147		-
148	79	if (!$json_api->query->cookie) {
149	80	$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method.");
150		-
151		- }
152		-
	81	+ }
153	82	$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
154		-
155	83	if (!$user_id) {
156	84	$json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method.");
157	85	}
158		-
159	86	$user = get_userdata($user_id);
160		- preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
161		-
	87	+ preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar);
162	88	return array(
163	89	"user" => array(
164	90	"id" => $user->ID,
165	91	"username" => $user->user_login,
		@@ -172,13 +98,9 @@
172	98	"lastname" => $user->last_name,
173	99	"nickname" => $user->nickname,
174	100	"description" => $user->user_description,
175	101	"capabilities" => $user->wp_capabilities,
176		-
177	102	"avatar" => $avatar[1]
178		-
179	103	)
180		-
181	104	);
182		-
183		- }
	105	+ }
184	106	}