json-api-auth / controllers / Auth.php

Auth.php in JSON API Auth 3.1.1, at controllers/Auth.php

138 lines 4.4 KB

Raw Download Zip

1	<?php
2	/*
3	Controller Name: Auth
4	Controller Description: Authentication add-on controller for the Wordpress JSON API plugin
5	Controller Author: Matt Berg, Ali Qureshi
6	Controller Author Twitter: @parorrey
7	*/
8
9
10	class JSON_API_Auth_Controller
11	{
12	public function __construct()
13	{
14	global $json_api;
15	// allow only connection over https. because, well, you care about your passwords and sniffing.
16	// turn this sanity-check off if you feel safe inside your localhost or intranet.
17	// send an extra POST parameter: insecure=cool
18	if (
19	empty($_SERVER['HTTPS']) \|\|
20	(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')
21	) {
22	if (empty($_REQUEST['insecure']) \|\| $_REQUEST['insecure'] != 'cool') {
23	$json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)");
24	}
25	}
26	$allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce');
27	foreach ($allowed_from_post as $param) {
28	if (isset($_POST[$param])) {
29	$json_api->query->$param = sanitize_text_field( $_POST[$param] );
30	}
31	}
32	}
33
34	public function validate_auth_cookie()
35	{
36	global $json_api;
37	if (!$json_api->query->cookie) {
38	$json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method.");
39	}
40	$valid = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in') ? true : false;
41	return array(
42	"valid" => $valid
43	);
44	}
45
46	public function generate_auth_cookie()
47	{
48	global $json_api;
49	if (!$json_api->query->username) {
50	$json_api->error("You must include a 'username' var in your request.");
51	}
52	if (!$json_api->query->password) {
53	$json_api->error("You must include a 'password' var in your request.");
54	}
55	if ($json_api->query->seconds)
56	$seconds = (int) $json_api->query->seconds;
57	else
58	$seconds = 1209600; //14 days
59	$user = wp_authenticate($json_api->query->username, $json_api->query->password);
60	if (is_wp_error($user)) {
61	remove_action('wp_login_failed', $json_api->query->username);
62	$json_api->error("Invalid username and/or password.", 'error', '401');
63
64	}
65	$expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
66	$cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
67
68	// Use get_avatar_url() (WP 4.2+) with fallback to regex for older installs
69	$avatar_icon = null;
70	if ( function_exists('get_avatar_url') ) {
71	$avatar_icon = get_avatar_url( $user->ID, array( 'size' => 32 ) );
72	} else {
73	preg_match('\|src=["\']([^"\']+)["\']\|', get_avatar($user->ID, 32), $avatar);
74	$avatar_icon = isset($avatar[1]) ? $avatar[1] : null;
75	}
76
77	return array(
78	"cookie" => $cookie,
79	"cookie_name" => LOGGED_IN_COOKIE,
80	"user" => array(
81	"id" => $user->ID,
82	"username" => $user->user_login,
83	"nicename" => $user->user_nicename,
84	"email" => $user->user_email,
85	"url" => $user->user_url,
86	"registered" => $user->user_registered,
87	"displayname" => $user->display_name,
88	"firstname" => $user->user_firstname,
89	"lastname" => $user->last_name,
90	"nickname" => $user->nickname,
91	"description" => $user->user_description,
92	"capabilities" => $user->roles,
93	"avatar" => $avatar_icon
94	),
95	);
96	}
97
98	public function get_currentuserinfo()
99	{
100	global $json_api;
101	if (!$json_api->query->cookie) {
102	$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method.");
103	}
104	$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
105	if (!$user_id) {
106	$json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method.");
107	}
108	$user = get_userdata($user_id);
109
110	// Use get_avatar_url() (WP 4.2+) with fallback to regex for older installs
111	$avatar_icon = null;
112	if ( function_exists('get_avatar_url') ) {
113	$avatar_icon = get_avatar_url( $user->ID, array( 'size' => 32 ) );
114	} else {
115	preg_match('\|src=["\']([^"\']+)["\']\|', get_avatar($user->ID, 32), $avatar);
116	$avatar_icon = isset($avatar[1]) ? $avatar[1] : null;
117	}
118
119	return array(
120	"user" => array(
121	"id" => $user->ID,
122	"username" => $user->user_login,
123	"nicename" => $user->user_nicename,
124	"email" => $user->user_email,
125	"url" => $user->user_url,
126	"registered" => $user->user_registered,
127	"displayname" => $user->display_name,
128	"firstname" => $user->user_firstname,
129	"lastname" => $user->last_name,
130	"nickname" => $user->nickname,
131	"description" => $user->user_description,
132	"capabilities" => $user->roles,
133	"avatar" => $avatar_icon
134	)
135	);
136	}
137	}
138