| @@ -1,120 +1,106 @@ | ||
| 1 | -<?php | |
| 2 | -/* | |
| 3 | -Controller Name: Auth | |
| 4 | -Controller Description: Authentication add-on controller for the Wordpress JSON API plugin | |
| 5 | -Controller Author: Matt Berg, Ali Qureshi | |
| 6 | -Controller Author Twitter: @parorrey | |
| 7 | -*/ | |
| 8 | - | |
| 9 | - | |
| 10 | -class JSON_API_Auth_Controller | |
| 11 | -{ | |
| 12 | - public function __construct() | |
| 13 | - { | |
| 14 | - global $json_api; | |
| 15 | - // allow only connection over https. because, well, you care about your passwords and sniffing. | |
| 16 | - // turn this sanity-check off if you feel safe inside your localhost or intranet. | |
| 17 | - // send an extra POST parameter: insecure=cool | |
| 18 | - if ( | |
| 19 | - empty($_SERVER['HTTPS']) || | |
| 20 | - (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off') | |
| 21 | - ) { | |
| 22 | - if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') { | |
| 23 | - $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)"); | |
| 24 | - } | |
| 25 | - } | |
| 26 | - $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce'); | |
| 27 | - foreach ($allowed_from_post as $param) { | |
| 28 | - if (isset($_POST[$param])) { | |
| 29 | - $json_api->query->$param = $_POST[$param]; | |
| 30 | - } | |
| 31 | - } | |
| 32 | - } | |
| 33 | - public function validate_auth_cookie() | |
| 34 | - { | |
| 35 | - global $json_api; | |
| 36 | - if (!$json_api->query->cookie) { | |
| 37 | - $json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method."); | |
| 38 | - } | |
| 39 | - $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false; | |
| 40 | - return array( | |
| 41 | - "valid" => $valid | |
| 42 | - ); | |
| 43 | - } | |
| 44 | - public function generate_auth_cookie() | |
| 45 | - { | |
| 46 | - global $json_api; | |
| 47 | - if (!$json_api->query->username) { | |
| 48 | - $json_api->error("You must include a 'username' var in your request."); | |
| 49 | - } | |
| 50 | - if (!$json_api->query->password) { | |
| 51 | - $json_api->error("You must include a 'password' var in your request."); | |
| 52 | - } | |
| 53 | - if ($json_api->query->seconds) | |
| 54 | - $seconds = (int) $json_api->query->seconds; | |
| 55 | - else | |
| 56 | - $seconds = 1209600; //14 days | |
| 57 | - $user = wp_authenticate($json_api->query->username, $json_api->query->password); | |
| 58 | - if (is_wp_error($user)) { | |
| 59 | - remove_action('wp_login_failed', $json_api->query->username); | |
| 60 | - $json_api->error("Invalid username and/or password.", 'error', '401'); | |
| 61 | - | |
| 62 | - } | |
| 63 | - $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true); | |
| 64 | - $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in'); | |
| 65 | - preg_match('|src="(.+?)"|', get_avatar($user->ID, 32), $avatar); | |
| 66 | - $avatar_icon = isset($avatar[1]) ? $avatar[1] : NULL; | |
| 67 | - | |
| 68 | - return array( | |
| 69 | - "cookie" => $cookie, | |
| 70 | - "cookie_name" => LOGGED_IN_COOKIE, | |
| 71 | - "user" => array( | |
| 72 | - "id" => $user->ID, | |
| 73 | - "username" => $user->user_login, | |
| 74 | - "nicename" => $user->user_nicename, | |
| 75 | - "email" => $user->user_email, | |
| 76 | - "url" => $user->user_url, | |
| 77 | - "registered" => $user->user_registered, | |
| 78 | - "displayname" => $user->display_name, | |
| 79 | - "firstname" => $user->user_firstname, | |
| 80 | - "lastname" => $user->last_name, | |
| 81 | - "nickname" => $user->nickname, | |
| 82 | - "description" => $user->user_description, | |
| 83 | - "capabilities" => $user->wp_capabilities, | |
| 84 | - "avatar" => $avatar_icon | |
| 85 | - ), | |
| 86 | - ); | |
| 87 | - } | |
| 88 | - public function get_currentuserinfo() | |
| 89 | - { | |
| 90 | - global $json_api; | |
| 91 | - if (!$json_api->query->cookie) { | |
| 92 | - $json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method."); | |
| 93 | - } | |
| 94 | - $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); | |
| 95 | - if (!$user_id) { | |
| 96 | - $json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method."); | |
| 97 | - } | |
| 98 | - $user = get_userdata($user_id); | |
| 99 | - preg_match('|src="(.+?)"|', get_avatar($user->ID, 32), $avatar); | |
| 100 | - $avatar_icon = isset($avatar[1]) ? $avatar[1] : NULL; | |
| 101 | - | |
| 102 | - return array( | |
| 103 | - "user" => array( | |
| 104 | - "id" => $user->ID, | |
| 105 | - "username" => $user->user_login, | |
| 106 | - "nicename" => $user->user_nicename, | |
| 107 | - "email" => $user->user_email, | |
| 108 | - "url" => $user->user_url, | |
| 109 | - "registered" => $user->user_registered, | |
| 110 | - "displayname" => $user->display_name, | |
| 111 | - "firstname" => $user->user_firstname, | |
| 112 | - "lastname" => $user->last_name, | |
| 113 | - "nickname" => $user->nickname, | |
| 114 | - "description" => $user->user_description, | |
| 115 | - "capabilities" => $user->wp_capabilities, | |
| 116 | - "avatar" => $avatar_icon | |
| 117 | - ) | |
| 118 | - ); | |
| 119 | - } | |
| 1 | +<?php | |
| 2 | +/* | |
| 3 | +Controller Name: Auth | |
| 4 | +Controller Description: Authentication add-on controller for the Wordpress JSON API plugin | |
| 5 | +Controller Author: Matt Berg, Ali Qureshi | |
| 6 | +Controller Author Twitter: @parorrey | |
| 7 | +*/ | |
| 8 | + | |
| 9 | + | |
| 10 | +class JSON_API_Auth_Controller { | |
| 11 | + public function __construct() { | |
| 12 | + global $json_api; | |
| 13 | + // allow only connection over https. because, well, you care about your passwords and sniffing. | |
| 14 | + // turn this sanity-check off if you feel safe inside your localhost or intranet. | |
| 15 | + // send an extra POST parameter: insecure=cool | |
| 16 | + if (empty($_SERVER['HTTPS']) || | |
| 17 | + (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')) { | |
| 18 | + if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') { | |
| 19 | + $json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)"); | |
| 20 | + } | |
| 21 | + } | |
| 22 | + $allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce'); | |
| 23 | + foreach($allowed_from_post as $param) { | |
| 24 | + if (isset($_POST[$param])) { | |
| 25 | + $json_api->query->$param = $_POST[$param]; | |
| 26 | + } | |
| 27 | + } | |
| 28 | + } | |
| 29 | + public function validate_auth_cookie() { | |
| 30 | + global $json_api; | |
| 31 | + if (!$json_api->query->cookie) { | |
| 32 | + $json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method."); | |
| 33 | + } | |
| 34 | + $valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false; | |
| 35 | + return array( | |
| 36 | + "valid" => $valid | |
| 37 | + ); | |
| 38 | + } | |
| 39 | + public function generate_auth_cookie() { | |
| 40 | + global $json_api; | |
| 41 | + if (!$json_api->query->username) { | |
| 42 | + $json_api->error("You must include a 'username' var in your request."); | |
| 43 | + } | |
| 44 | + if (!$json_api->query->password) { | |
| 45 | + $json_api->error("You must include a 'password' var in your request."); | |
| 46 | + } | |
| 47 | + if ($json_api->query->seconds) $seconds = (int) $json_api->query->seconds; | |
| 48 | + else $seconds = 1209600;//14 days | |
| 49 | + $user = wp_authenticate($json_api->query->username, $json_api->query->password); | |
| 50 | + if (is_wp_error($user)) { | |
| 51 | + $json_api->error("Invalid username and/or password.", 'error', '401'); | |
| 52 | + remove_action('wp_login_failed', $json_api->query->username); | |
| 53 | + } | |
| 54 | + $expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true); | |
| 55 | + $cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in'); | |
| 56 | + preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 57 | + return array( | |
| 58 | + "cookie" => $cookie, | |
| 59 | + "cookie_name" => LOGGED_IN_COOKIE, | |
| 60 | + "user" => array( | |
| 61 | + "id" => $user->ID, | |
| 62 | + "username" => $user->user_login, | |
| 63 | + "nicename" => $user->user_nicename, | |
| 64 | + "email" => $user->user_email, | |
| 65 | + "url" => $user->user_url, | |
| 66 | + "registered" => $user->user_registered, | |
| 67 | + "displayname" => $user->display_name, | |
| 68 | + "firstname" => $user->user_firstname, | |
| 69 | + "lastname" => $user->last_name, | |
| 70 | + "nickname" => $user->nickname, | |
| 71 | + "description" => $user->user_description, | |
| 72 | + "capabilities" => $user->wp_capabilities, | |
| 73 | + "avatar" => $avatar[1] | |
| 74 | + ), | |
| 75 | + ); | |
| 76 | + } | |
| 77 | + public function get_currentuserinfo() { | |
| 78 | + global $json_api; | |
| 79 | + if (!$json_api->query->cookie) { | |
| 80 | + $json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method."); | |
| 81 | + } | |
| 82 | + $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); | |
| 83 | + if (!$user_id) { | |
| 84 | + $json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method."); | |
| 85 | + } | |
| 86 | + $user = get_userdata($user_id); | |
| 87 | + preg_match('|src="(.+?)"|', get_avatar( $user->ID, 32 ), $avatar); | |
| 88 | + return array( | |
| 89 | + "user" => array( | |
| 90 | + "id" => $user->ID, | |
| 91 | + "username" => $user->user_login, | |
| 92 | + "nicename" => $user->user_nicename, | |
| 93 | + "email" => $user->user_email, | |
| 94 | + "url" => $user->user_url, | |
| 95 | + "registered" => $user->user_registered, | |
| 96 | + "displayname" => $user->display_name, | |
| 97 | + "firstname" => $user->user_firstname, | |
| 98 | + "lastname" => $user->last_name, | |
| 99 | + "nickname" => $user->nickname, | |
| 100 | + "description" => $user->user_description, | |
| 101 | + "capabilities" => $user->wp_capabilities, | |
| 102 | + "avatar" => $avatar[1] | |
| 103 | + ) | |
| 104 | + ); | |
| 105 | + } | |
| 120 | 106 | } |
