| 1 |
<?php |
| 2 |
|
| 3 |
/* |
| 4 |
Controller name: User |
| 5 |
Controller description: User Registration, Authentication, User Info, User Meta, FB Login, BuddyPress xProfile Fields methods |
| 6 |
Controller Author: Ali Qureshi |
| 7 |
Controller Author Twitter: @parorrey |
| 8 |
Controller Author Website: parorrey.com |
| 9 |
|
| 10 |
*/ |
| 11 |
class JSON_API_User_Controller |
| 12 |
{ |
| 13 |
|
| 14 |
/** |
| 15 |
* Returns an Array with registered userid & valid cookie |
| 16 |
* @param String username: username to register |
| 17 |
* @param String email: email address for user registration |
| 18 |
* @param String user_pass: user_pass to be set (optional) |
| 19 |
* @param String display_name: display_name for user |
| 20 |
*/ |
| 21 |
public function __construct() |
| 22 |
{ |
| 23 |
global $json_api; |
| 24 |
// allow only connection over https. because, well, you care about your passwords and sniffing. |
| 25 |
// turn this sanity-check off if you feel safe inside your localhost or intranet. |
| 26 |
// send an extra POST parameter: insecure=cool |
| 27 |
if ( |
| 28 |
empty($_SERVER['HTTPS']) || |
| 29 |
(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off') |
| 30 |
) { |
| 31 |
if (empty($_REQUEST['insecure']) || $_REQUEST['insecure'] != 'cool') { |
| 32 |
$json_api->error("SSL is not enabled. Either use _https_ or provide 'insecure' var as insecure=cool to confirm you want to use http protocol."); |
| 33 |
} |
| 34 |
} |
| 35 |
|
| 36 |
|
| 37 |
} |
| 38 |
|
| 39 |
public function info() |
| 40 |
{ |
| 41 |
|
| 42 |
global $json_api; |
| 43 |
|
| 44 |
return array( |
| 45 |
"version" => JAU_VERSION, |
| 46 |
"php" => PHP_VERSION |
| 47 |
); |
| 48 |
|
| 49 |
} |
| 50 |
|
| 51 |
public function register() |
| 52 |
{ |
| 53 |
|
| 54 |
global $json_api, $wpdb; |
| 55 |
|
| 56 |
|
| 57 |
if (!get_option('users_can_register')) { |
| 58 |
$json_api->error("User registration is disabled. Please enable it in Settings > General."); |
| 59 |
} |
| 60 |
|
| 61 |
if (!$json_api->query->username) { |
| 62 |
$json_api->error("You must include 'username' var in your request. "); |
| 63 |
} else |
| 64 |
$username = sanitize_user($json_api->query->username); |
| 65 |
|
| 66 |
|
| 67 |
if (!$json_api->query->email) { |
| 68 |
$json_api->error("You must include 'email' var in your request. "); |
| 69 |
} else |
| 70 |
$email = sanitize_email($json_api->query->email); |
| 71 |
|
| 72 |
if (!$json_api->query->nonce) { |
| 73 |
$json_api->error("You must include 'nonce' var in your request. Use the 'get_nonce' Core API method. "); |
| 74 |
} else |
| 75 |
$nonce = sanitize_text_field($json_api->query->nonce); |
| 76 |
|
| 77 |
if ($json_api->query->display_name) { |
| 78 |
$display_name = sanitize_text_field($json_api->query->display_name); |
| 79 |
} |
| 80 |
|
| 81 |
|
| 82 |
$user_pass = sanitize_text_field($_REQUEST['user_pass']); |
| 83 |
|
| 84 |
if ($json_api->query->seconds) |
| 85 |
$seconds = (int) $json_api->query->seconds; |
| 86 |
else |
| 87 |
$seconds = 1209600; //14 days |
| 88 |
|
| 89 |
//Add usernames we don't want used |
| 90 |
|
| 91 |
$invalid_usernames = array('admin'); |
| 92 |
|
| 93 |
//Do username validation |
| 94 |
|
| 95 |
$nonce_id = $json_api->get_nonce_id('user', 'register'); |
| 96 |
|
| 97 |
if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) { |
| 98 |
|
| 99 |
$json_api->error("Invalid access, unverifiable 'nonce' value. Use the 'get_nonce' Core API method. "); |
| 100 |
} else { |
| 101 |
|
| 102 |
if (!validate_username($username) || in_array($username, $invalid_usernames)) { |
| 103 |
|
| 104 |
$json_api->error("Username is invalid."); |
| 105 |
|
| 106 |
} elseif (username_exists($username)) { |
| 107 |
|
| 108 |
$json_api->error("Username already exists."); |
| 109 |
|
| 110 |
} else { |
| 111 |
|
| 112 |
|
| 113 |
if (!is_email($email)) { |
| 114 |
$json_api->error("E-mail address is invalid."); |
| 115 |
} elseif (email_exists($email)) { |
| 116 |
|
| 117 |
$json_api->error("E-mail address is already in use."); |
| 118 |
|
| 119 |
} else { |
| 120 |
|
| 121 |
//Everything has been validated, proceed with creating the user |
| 122 |
|
| 123 |
//Create the user |
| 124 |
|
| 125 |
if (!isset($_REQUEST['user_pass'])) { |
| 126 |
$user_pass = wp_generate_password(); |
| 127 |
$_REQUEST['user_pass'] = $user_pass; |
| 128 |
} |
| 129 |
|
| 130 |
$_REQUEST['user_login'] = $username; |
| 131 |
$_REQUEST['user_email'] = $email; |
| 132 |
|
| 133 |
$allowed_params = array( |
| 134 |
'user_login', |
| 135 |
'user_email', |
| 136 |
'user_pass', |
| 137 |
'display_name', |
| 138 |
'user_nicename', |
| 139 |
'user_url', |
| 140 |
'nickname', |
| 141 |
'first_name', |
| 142 |
'last_name', |
| 143 |
'description', |
| 144 |
'rich_editing', |
| 145 |
'user_registered', |
| 146 |
'role', |
| 147 |
'jabber', |
| 148 |
'aim', |
| 149 |
'yim', |
| 150 |
'comment_shortcuts', |
| 151 |
'admin_color', |
| 152 |
'use_ssl', |
| 153 |
'show_admin_bar_front' |
| 154 |
); |
| 155 |
|
| 156 |
|
| 157 |
foreach ($_REQUEST as $field => $value) { |
| 158 |
|
| 159 |
if (in_array($field, $allowed_params)) |
| 160 |
$user[$field] = trim(sanitize_text_field($value)); |
| 161 |
|
| 162 |
} |
| 163 |
$user['role'] = get_option('default_role'); |
| 164 |
$user_id = wp_insert_user($user); |
| 165 |
|
| 166 |
/*Send e-mail to admin and new user - |
| 167 |
You could create your own e-mail instead of using this function*/ |
| 168 |
|
| 169 |
if (isset($_REQUEST['user_pass']) && $_REQUEST['notify'] == 'no') { |
| 170 |
$notify = ''; |
| 171 |
} elseif ($_REQUEST['notify'] != 'no') |
| 172 |
$notify = $_REQUEST['notify']; |
| 173 |
|
| 174 |
|
| 175 |
if ($user_id) |
| 176 |
wp_new_user_notification($user_id, '', $notify); |
| 177 |
|
| 178 |
|
| 179 |
} |
| 180 |
} |
| 181 |
} |
| 182 |
|
| 183 |
if(is_array($json_api->query->custom_fields)) { |
| 184 |
$custom_fields = $json_api->query->custom_fields; |
| 185 |
|
| 186 |
$keys = array_keys($custom_fields); |
| 187 |
$keys = array_map('sanitize_key', $keys); |
| 188 |
$values = array_values($custom_fields); |
| 189 |
$values = array_map('sanitize_text_field', $values); |
| 190 |
|
| 191 |
$custom_fields = array_combine($keys, $values); |
| 192 |
|
| 193 |
} |
| 194 |
|
| 195 |
if ($user_id) { |
| 196 |
$disallowed = array("wp_user_level", "wp_capabilities", "{$wpdb->prefix}user_level", "{$wpdb->prefix}capabilities"); |
| 197 |
|
| 198 |
if ( !empty($custom_fields) && is_array($custom_fields)) { |
| 199 |
|
| 200 |
foreach ($custom_fields as $field => $val) { |
| 201 |
if(!in_array($field, $disallowed)){ |
| 202 |
foreach($disallowed as $d){ |
| 203 |
$field = str_replace($d, 'disallowed', $field); |
| 204 |
} |
| 205 |
|
| 206 |
$data[$field] = update_user_meta($user_id, $field, $val); |
| 207 |
} |
| 208 |
|
| 209 |
|
| 210 |
} |
| 211 |
} |
| 212 |
|
| 213 |
$expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user_id, true); |
| 214 |
|
| 215 |
$cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in'); |
| 216 |
$cookie_admin = wp_generate_auth_cookie($user_id, $expiration, 'secure_auth'); |
| 217 |
|
| 218 |
$user_info = get_userdata($user_id); |
| 219 |
} |
| 220 |
|
| 221 |
return array( |
| 222 |
"cookie" => $cookie, |
| 223 |
"cookie_admin" => $cookie_admin, |
| 224 |
"cookie_name" => LOGGED_IN_COOKIE, |
| 225 |
"user_id" => $user_id, |
| 226 |
"username" => $user_info->user_login |
| 227 |
); |
| 228 |
|
| 229 |
} |
| 230 |
|
| 231 |
public function get_avatar() |
| 232 |
{ |
| 233 |
|
| 234 |
global $json_api; |
| 235 |
|
| 236 |
if (function_exists('bp_is_active')) { |
| 237 |
|
| 238 |
if (!$json_api->query->user_id) { |
| 239 |
$json_api->error("You must include 'user_id' var in your request. "); |
| 240 |
} |
| 241 |
|
| 242 |
if (!$json_api->query->type) { |
| 243 |
$json_api->error("You must include 'type' var in your request. possible values 'full' or 'thumb' "); |
| 244 |
} |
| 245 |
|
| 246 |
|
| 247 |
$avatar = bp_core_fetch_avatar(array('item_id' => $json_api->query->user_id, 'type' => $json_api->query->type, 'html' => false)); |
| 248 |
|
| 249 |
return array('avatar' => $avatar); |
| 250 |
} else { |
| 251 |
|
| 252 |
$json_api->error("You must install and activate BuddyPress plugin to use this method."); |
| 253 |
|
| 254 |
} |
| 255 |
|
| 256 |
} |
| 257 |
|
| 258 |
public function get_userinfo() |
| 259 |
{ |
| 260 |
|
| 261 |
global $json_api; |
| 262 |
|
| 263 |
if (!$json_api->query->user_id) { |
| 264 |
$json_api->error("You must include 'user_id' var in your request. "); |
| 265 |
} |
| 266 |
|
| 267 |
$user = get_userdata($json_api->query->user_id); |
| 268 |
|
| 269 |
preg_match('|src="(.+?)"|', get_avatar($user->ID, 32), $avatar); |
| 270 |
$avatar_icon = isset($avatar[1]) ? $avatar[1] : NULL; |
| 271 |
|
| 272 |
return array( |
| 273 |
"id" => $user->ID, |
| 274 |
//"username" => $user->user_login, |
| 275 |
"nicename" => $user->user_nicename, |
| 276 |
//"email" => $user->user_email, |
| 277 |
"url" => $user->user_url, |
| 278 |
"displayname" => $user->display_name, |
| 279 |
"firstname" => $user->user_firstname, |
| 280 |
"lastname" => $user->last_name, |
| 281 |
"nickname" => $user->nickname, |
| 282 |
"avatar" => $avatar_icon |
| 283 |
); |
| 284 |
|
| 285 |
} |
| 286 |
|
| 287 |
public function retrieve_password() |
| 288 |
{ |
| 289 |
|
| 290 |
global $wpdb, $json_api, $wp_hasher; |
| 291 |
|
| 292 |
if (!$json_api->query->user_login) { |
| 293 |
|
| 294 |
$json_api->error("You must include 'user_login' var in your request. "); |
| 295 |
|
| 296 |
} |
| 297 |
|
| 298 |
$user_login = $json_api->query->user_login; |
| 299 |
|
| 300 |
if (strpos($user_login, '@')) { |
| 301 |
|
| 302 |
$user_data = get_user_by('email', trim($user_login)); |
| 303 |
|
| 304 |
if (empty($user_data)) |
| 305 |
|
| 306 |
|
| 307 |
|
| 308 |
$json_api->error("Your email address not found! "); |
| 309 |
|
| 310 |
|
| 311 |
|
| 312 |
} else { |
| 313 |
|
| 314 |
$login = trim($user_login); |
| 315 |
|
| 316 |
$user_data = get_user_by('login', $login); |
| 317 |
|
| 318 |
} |
| 319 |
|
| 320 |
|
| 321 |
|
| 322 |
// redefining user_login ensures we return the right case in the email |
| 323 |
|
| 324 |
$user_login = $user_data->user_login; |
| 325 |
|
| 326 |
$user_email = $user_data->user_email; |
| 327 |
|
| 328 |
|
| 329 |
do_action('retrieve_password', $user_login); |
| 330 |
|
| 331 |
|
| 332 |
$allow = apply_filters('allow_password_reset', true, $user_data->ID); |
| 333 |
|
| 334 |
if (!$allow) |
| 335 |
$json_api->error("password reset not allowed! "); |
| 336 |
elseif (is_wp_error($allow)) |
| 337 |
$json_api->error("An error occured! "); |
| 338 |
|
| 339 |
|
| 340 |
|
| 341 |
$key = wp_generate_password(20, false); |
| 342 |
|
| 343 |
do_action('retrieve_password_key', $user_login, $key); |
| 344 |
|
| 345 |
|
| 346 |
|
| 347 |
if (empty($wp_hasher)) { |
| 348 |
|
| 349 |
require_once ABSPATH . 'wp-includes/class-phpass.php'; |
| 350 |
|
| 351 |
$wp_hasher = new PasswordHash(8, true); |
| 352 |
|
| 353 |
} |
| 354 |
|
| 355 |
|
| 356 |
$hashed = time() . ':' . $wp_hasher->HashPassword($key); |
| 357 |
|
| 358 |
$wpdb->update($wpdb->users, array('user_activation_key' => $hashed), array('user_login' => $user_login)); |
| 359 |
|
| 360 |
$message = __('Someone requested that the password be reset for the following account:') . "\r\n\r\n"; |
| 361 |
|
| 362 |
$message .= network_home_url('/') . "\r\n\r\n"; |
| 363 |
|
| 364 |
$message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n"; |
| 365 |
|
| 366 |
$message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n"; |
| 367 |
|
| 368 |
$message .= __('To reset your password, visit the following address:') . "\r\n\r\n"; |
| 369 |
|
| 370 |
$message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n"; |
| 371 |
|
| 372 |
|
| 373 |
|
| 374 |
if (is_multisite()) |
| 375 |
|
| 376 |
$blogname = $GLOBALS['current_site']->site_name; |
| 377 |
else |
| 378 |
|
| 379 |
$blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES); |
| 380 |
|
| 381 |
|
| 382 |
|
| 383 |
$title = sprintf(__('[%s] Password Reset'), $blogname); |
| 384 |
|
| 385 |
|
| 386 |
|
| 387 |
$title = apply_filters('retrieve_password_title', $title); |
| 388 |
|
| 389 |
$message = apply_filters('retrieve_password_message', $message, $key); |
| 390 |
|
| 391 |
|
| 392 |
|
| 393 |
if ($message && !wp_mail($user_email, $title, $message)) |
| 394 |
|
| 395 |
$json_api->error("The e-mail could not be sent. Possible reason: your host may have disabled the mail() function..."); |
| 396 |
else |
| 397 |
|
| 398 |
return array( |
| 399 |
|
| 400 |
"msg" => 'Link for password reset has been emailed to you. Please check your email.', |
| 401 |
|
| 402 |
); |
| 403 |
|
| 404 |
} |
| 405 |
|
| 406 |
public function validate_auth_cookie() |
| 407 |
{ |
| 408 |
|
| 409 |
global $json_api; |
| 410 |
|
| 411 |
|
| 412 |
if (!$json_api->query->cookie) { |
| 413 |
|
| 414 |
$json_api->error("You must include a 'cookie' authentication cookie. Use the `generate_auth_cookie` method."); |
| 415 |
|
| 416 |
} |
| 417 |
|
| 418 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 419 |
|
| 420 |
$valid = $user_id ? true : false; |
| 421 |
|
| 422 |
return array( |
| 423 |
|
| 424 |
"valid" => $valid, |
| 425 |
"user_id" => $user_id |
| 426 |
|
| 427 |
); |
| 428 |
|
| 429 |
} |
| 430 |
|
| 431 |
public function generate_auth_cookie() |
| 432 |
{ |
| 433 |
|
| 434 |
global $json_api; |
| 435 |
|
| 436 |
foreach ($_POST as $k => $val) { |
| 437 |
if (isset($_POST[$k])) { |
| 438 |
$json_api->query->$k = $val; |
| 439 |
} |
| 440 |
} |
| 441 |
|
| 442 |
|
| 443 |
if (!$json_api->query->username && !$json_api->query->email) { |
| 444 |
|
| 445 |
$json_api->error("You must include 'username' or 'email' var in your request to generate cookie."); |
| 446 |
|
| 447 |
} |
| 448 |
|
| 449 |
|
| 450 |
if (!$json_api->query->password) { |
| 451 |
|
| 452 |
$json_api->error("You must include a 'password' var in your request."); |
| 453 |
|
| 454 |
} |
| 455 |
|
| 456 |
if ($json_api->query->seconds) |
| 457 |
$seconds = (int) $json_api->query->seconds; |
| 458 |
else |
| 459 |
$seconds = 1209600; //14 days |
| 460 |
|
| 461 |
if ($json_api->query->email) { |
| 462 |
|
| 463 |
|
| 464 |
if (is_email($json_api->query->email)) { |
| 465 |
if (!email_exists($json_api->query->email)) { |
| 466 |
$json_api->error("email does not exist."); |
| 467 |
} |
| 468 |
} else |
| 469 |
$json_api->error("Invalid email address."); |
| 470 |
|
| 471 |
$user_obj = get_user_by('email', $json_api->query->email); |
| 472 |
|
| 473 |
|
| 474 |
$user = wp_authenticate($user_obj->data->user_login, $json_api->query->password); |
| 475 |
} else { |
| 476 |
|
| 477 |
$user = wp_authenticate($json_api->query->username, $json_api->query->password); |
| 478 |
} |
| 479 |
|
| 480 |
|
| 481 |
if (is_wp_error($user)) { |
| 482 |
|
| 483 |
remove_action('wp_login_failed', $json_api->query->username); |
| 484 |
$json_api->error("Invalid username/email and/or password.", 'error', '401'); |
| 485 |
|
| 486 |
} |
| 487 |
|
| 488 |
|
| 489 |
$expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true); |
| 490 |
|
| 491 |
$cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in'); |
| 492 |
$cookie_admin = wp_generate_auth_cookie($user->ID, $expiration, 'secure_auth'); |
| 493 |
|
| 494 |
preg_match('|src="(.+?)"|', get_avatar($user->ID, 512), $avatar); |
| 495 |
$avatar_icon = isset($avatar[1]) ? $avatar[1] : NULL; |
| 496 |
|
| 497 |
|
| 498 |
return array( |
| 499 |
"cookie" => $cookie, |
| 500 |
"cookie_admin" => $cookie_admin, |
| 501 |
"cookie_name" => LOGGED_IN_COOKIE, |
| 502 |
"user" => array( |
| 503 |
"id" => $user->ID, |
| 504 |
"username" => $user->user_login, |
| 505 |
"nicename" => $user->user_nicename, |
| 506 |
"email" => $user->user_email, |
| 507 |
"url" => $user->user_url, |
| 508 |
"registered" => $user->user_registered, |
| 509 |
"displayname" => $user->display_name, |
| 510 |
"firstname" => $user->user_firstname, |
| 511 |
"lastname" => $user->last_name, |
| 512 |
"nickname" => $user->nickname, |
| 513 |
"description" => $user->user_description, |
| 514 |
"capabilities" => $user->wp_capabilities, |
| 515 |
"avatar" => $avatar_icon |
| 516 |
|
| 517 |
), |
| 518 |
); |
| 519 |
} |
| 520 |
|
| 521 |
public function get_currentuserinfo() |
| 522 |
{ |
| 523 |
|
| 524 |
global $json_api; |
| 525 |
|
| 526 |
if (!$json_api->query->cookie) { |
| 527 |
|
| 528 |
$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method."); |
| 529 |
|
| 530 |
} |
| 531 |
|
| 532 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 533 |
|
| 534 |
|
| 535 |
if (!$user_id) { |
| 536 |
$json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` method."); |
| 537 |
} |
| 538 |
|
| 539 |
$user = get_userdata($user_id); |
| 540 |
|
| 541 |
preg_match('|src="(.+?)"|', get_avatar($user->ID, 32), $avatar); |
| 542 |
|
| 543 |
$avatar_icon = isset($avatar[1]) ? $avatar[1] : NULL; |
| 544 |
|
| 545 |
return array( |
| 546 |
|
| 547 |
"user" => array( |
| 548 |
|
| 549 |
"id" => $user->ID, |
| 550 |
|
| 551 |
"username" => $user->user_login, |
| 552 |
|
| 553 |
"nicename" => $user->user_nicename, |
| 554 |
|
| 555 |
"email" => $user->user_email, |
| 556 |
|
| 557 |
"url" => $user->user_url, |
| 558 |
|
| 559 |
"registered" => $user->user_registered, |
| 560 |
|
| 561 |
"displayname" => $user->display_name, |
| 562 |
|
| 563 |
"firstname" => $user->user_firstname, |
| 564 |
|
| 565 |
"lastname" => $user->last_name, |
| 566 |
|
| 567 |
"nickname" => $user->nickname, |
| 568 |
|
| 569 |
"description" => $user->user_description, |
| 570 |
|
| 571 |
"capabilities" => $user->wp_capabilities, |
| 572 |
|
| 573 |
"avatar" => $avatar_icon |
| 574 |
|
| 575 |
) |
| 576 |
|
| 577 |
); |
| 578 |
|
| 579 |
} |
| 580 |
|
| 581 |
public function get_user_meta() |
| 582 |
{ |
| 583 |
|
| 584 |
global $json_api; |
| 585 |
|
| 586 |
if (!$json_api->query->cookie) { |
| 587 |
$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` method."); |
| 588 |
} |
| 589 |
|
| 590 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 591 |
|
| 592 |
if (!$user_id) |
| 593 |
$json_api->error("Invalid cookie. Use the `generate_auth_cookie` method."); |
| 594 |
|
| 595 |
$meta_key = sanitize_text_field($json_api->query->meta_key); |
| 596 |
|
| 597 |
|
| 598 |
if ($meta_key) |
| 599 |
$data[$meta_key] = get_user_meta($user_id, $meta_key); |
| 600 |
else { |
| 601 |
// Get all user meta data for $user_id |
| 602 |
$meta = get_user_meta($user_id); |
| 603 |
|
| 604 |
// Filter out empty meta data |
| 605 |
$data = array_filter(array_map(function ($a) { |
| 606 |
return $a[0]; |
| 607 |
}, $meta)); |
| 608 |
|
| 609 |
} |
| 610 |
//d($data); |
| 611 |
return $data; |
| 612 |
|
| 613 |
|
| 614 |
} |
| 615 |
|
| 616 |
public function update_user_meta() |
| 617 |
{ |
| 618 |
|
| 619 |
global $json_api, $wpdb; |
| 620 |
|
| 621 |
if (!$json_api->query->cookie) { |
| 622 |
$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` method."); |
| 623 |
} |
| 624 |
|
| 625 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 626 |
|
| 627 |
if (!$user_id) |
| 628 |
$json_api->error("Invalid cookie. Use the `generate_auth_cookie` method."); |
| 629 |
|
| 630 |
|
| 631 |
if (!$json_api->query->meta_key) |
| 632 |
$json_api->error("You must include a 'meta_key' var in your request."); |
| 633 |
else |
| 634 |
$meta_key = sanitize_text_field($json_api->query->meta_key); |
| 635 |
|
| 636 |
if (!$json_api->query->meta_value) { |
| 637 |
$json_api->error("You must include a 'meta_value' var in your request. If you have multiple values for any meta_key, you must send it as an array meta_value[] in POST method."); |
| 638 |
} else |
| 639 |
$meta_value = sanitize_text_field($json_api->query->meta_value); |
| 640 |
|
| 641 |
$disallowed = array("wp_user_level", "wp_capabilities", "{$wpdb->prefix}user_level", "{$wpdb->prefix}capabilities"); |
| 642 |
|
| 643 |
if(in_array($meta_key, $disallowed) ){ |
| 644 |
$json_api->error("This meta_key '".$meta_key."' is not allowed."); |
| 645 |
} |
| 646 |
|
| 647 |
if(!in_array($meta_key, $disallowed) ){ |
| 648 |
foreach($disallowed as $d){ |
| 649 |
$meta_key = str_replace($d, 'disallowed', $meta_key); |
| 650 |
} |
| 651 |
if (is_array($meta_value)) { |
| 652 |
|
| 653 |
$meta_values = array_map('trim', $meta_value); |
| 654 |
|
| 655 |
|
| 656 |
$data['updated'] = update_user_meta($user_id, $meta_key, $meta_values); |
| 657 |
} else |
| 658 |
$data['updated'] = update_user_meta($user_id, $meta_key, $meta_value); |
| 659 |
} |
| 660 |
|
| 661 |
return $data; |
| 662 |
|
| 663 |
} |
| 664 |
|
| 665 |
public function delete_user_meta() |
| 666 |
{ |
| 667 |
|
| 668 |
global $json_api; |
| 669 |
|
| 670 |
if (!$json_api->query->cookie) { |
| 671 |
$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` method."); |
| 672 |
} |
| 673 |
|
| 674 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 675 |
|
| 676 |
if (!$user_id) |
| 677 |
$json_api->error("Invalid cookie. Use the `generate_auth_cookie` method."); |
| 678 |
|
| 679 |
|
| 680 |
if (!$json_api->query->meta_key) |
| 681 |
$json_api->error("You must include a 'meta_key' var in your request."); |
| 682 |
else |
| 683 |
$meta_key = $json_api->query->meta_key; |
| 684 |
|
| 685 |
if (!$json_api->query->meta_value) { |
| 686 |
$json_api->error("You must include a 'meta_value' var in your request."); |
| 687 |
} else |
| 688 |
$meta_value = sanitize_text_field($json_api->query->meta_value); |
| 689 |
|
| 690 |
|
| 691 |
$data['deleted'] = delete_user_meta($user_id, $meta_key, $meta_value); |
| 692 |
|
| 693 |
return $data; |
| 694 |
|
| 695 |
} |
| 696 |
|
| 697 |
public function update_user_meta_vars() |
| 698 |
{ |
| 699 |
|
| 700 |
global $json_api, $wpdb; |
| 701 |
|
| 702 |
if (!$json_api->query->cookie) { |
| 703 |
$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` method."); |
| 704 |
} |
| 705 |
|
| 706 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 707 |
// echo '$user_id: '.$user_id; |
| 708 |
|
| 709 |
if (!$user_id) { |
| 710 |
$json_api->error("Invalid cookie. Use the `generate_auth_cookie` method."); |
| 711 |
} |
| 712 |
|
| 713 |
if (sizeof($_REQUEST) <= 1) |
| 714 |
$json_api->error("You must include one or more vars in your request to add or update as user_meta. e.g. 'name', 'website', 'skills'. You must submit via POST method and can send multiple meta_key vars in this format in custom_field param: custom_fields['name']=John. custom_fields['website']=google.com. If any field has the possibility to hold more than one value for any multi-select fields or check boxes, you must provide an array of values and use POST method."); |
| 715 |
|
| 716 |
$disallowed = array("wp_user_level", "wp_capabilities", "{$wpdb->prefix}user_level", "{$wpdb->prefix}capabilities"); |
| 717 |
|
| 718 |
if(is_array($json_api->query->custom_fields)) { |
| 719 |
$custom_fields = $json_api->query->custom_fields; |
| 720 |
|
| 721 |
$keys = array_keys($custom_fields); |
| 722 |
$keys = array_map('sanitize_key', $keys); |
| 723 |
$values = array_values($custom_fields); |
| 724 |
$values = array_map('sanitize_text_field', $values); |
| 725 |
|
| 726 |
$custom_fields = array_combine($keys, $values); |
| 727 |
|
| 728 |
} |
| 729 |
|
| 730 |
$result = array(); |
| 731 |
if( !empty($custom_fields) && is_array($custom_fields)){ |
| 732 |
|
| 733 |
|
| 734 |
foreach ($custom_fields as $field => $value) { |
| 735 |
|
| 736 |
if(in_array($field, $disallowed) ){ |
| 737 |
$json_api->error("This meta_key '".$field."' is not allowed."); |
| 738 |
} |
| 739 |
|
| 740 |
if ($field == 'cookie') |
| 741 |
continue; |
| 742 |
|
| 743 |
//$field_label = str_replace('_', ' ', $field); |
| 744 |
|
| 745 |
if (is_array($value)) { |
| 746 |
//$values = explode(",", $value); |
| 747 |
$values = array_map('trim', $values); |
| 748 |
} else |
| 749 |
$values = trim($value); |
| 750 |
|
| 751 |
if(!in_array($field, $disallowed) ){ |
| 752 |
foreach($disallowed as $d){ |
| 753 |
$field = str_replace($d, 'disallowed', $field); |
| 754 |
} |
| 755 |
$result[$field]['updated'] = update_user_meta($user_id, $field, $values); |
| 756 |
} |
| 757 |
|
| 758 |
} |
| 759 |
} |
| 760 |
|
| 761 |
return $result; |
| 762 |
|
| 763 |
} |
| 764 |
|
| 765 |
public function xprofile() |
| 766 |
{ |
| 767 |
|
| 768 |
global $json_api; |
| 769 |
|
| 770 |
if (function_exists('bp_is_active')) { |
| 771 |
|
| 772 |
if (!$json_api->query->user_id) { |
| 773 |
$json_api->error("You must include a 'user_id' var in your request."); |
| 774 |
} else |
| 775 |
$user_id = $json_api->query->user_id; |
| 776 |
|
| 777 |
|
| 778 |
if (!$json_api->query->field) { |
| 779 |
$json_api->error("You must include a 'field' var in your request. Use 'field=default' for all default fields."); |
| 780 |
} elseif ($json_api->query->field == 'default') { |
| 781 |
$field_label = 'First Name, Last Name, Bio'; /*you should add your own field labels here for quick viewing*/ |
| 782 |
} else |
| 783 |
$field_label = sanitize_text_field($json_api->query->field); |
| 784 |
|
| 785 |
|
| 786 |
$fields = explode(",", $field_label); |
| 787 |
|
| 788 |
if (is_array($fields)) { |
| 789 |
|
| 790 |
foreach ($fields as $k) { |
| 791 |
|
| 792 |
$fields_data[$k] = xprofile_get_field_data($k, $user_id); |
| 793 |
|
| 794 |
} |
| 795 |
|
| 796 |
return $fields_data; |
| 797 |
|
| 798 |
|
| 799 |
} |
| 800 |
|
| 801 |
} else { |
| 802 |
|
| 803 |
$json_api->error("You must install and activate BuddyPress plugin to use this method."); |
| 804 |
|
| 805 |
} |
| 806 |
|
| 807 |
} |
| 808 |
|
| 809 |
public function xprofile_update() |
| 810 |
{ |
| 811 |
|
| 812 |
global $json_api; |
| 813 |
|
| 814 |
if (function_exists('bp_is_active')) { |
| 815 |
|
| 816 |
if (!$json_api->query->cookie) { |
| 817 |
$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` method."); |
| 818 |
} |
| 819 |
|
| 820 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 821 |
// echo '$user_id: '.$user_id; |
| 822 |
|
| 823 |
if (!$user_id) { |
| 824 |
$json_api->error("Invalid cookie. Use the `generate_auth_cookie` method."); |
| 825 |
} |
| 826 |
|
| 827 |
|
| 828 |
foreach ($_REQUEST as $field => $value) { |
| 829 |
|
| 830 |
if ($field == 'cookie') |
| 831 |
continue; |
| 832 |
|
| 833 |
$field_label = str_replace('_', ' ', $field); |
| 834 |
|
| 835 |
if (strpos($value, ',') !== false) { |
| 836 |
$values = explode(",", $value); |
| 837 |
$values = array_map('trim', $values); |
| 838 |
} else |
| 839 |
$values = trim($value); |
| 840 |
//echo 'field-values: '.$field.'=>'.$value; |
| 841 |
//d($values); |
| 842 |
|
| 843 |
$result[$field_label]['updated'] = xprofile_set_field_data($field_label, $user_id, $values, $is_required = true); |
| 844 |
|
| 845 |
} |
| 846 |
|
| 847 |
return $result; |
| 848 |
} else { |
| 849 |
|
| 850 |
$json_api->error("You must install and activate BuddyPress plugin to use this method."); |
| 851 |
|
| 852 |
} |
| 853 |
|
| 854 |
} |
| 855 |
|
| 856 |
public function fb_connect() |
| 857 |
{ |
| 858 |
|
| 859 |
global $json_api; |
| 860 |
|
| 861 |
if ($json_api->query->fields) { |
| 862 |
|
| 863 |
$fields = $json_api->query->fields; |
| 864 |
|
| 865 |
} else |
| 866 |
$fields = 'id,name,first_name,last_name,email'; |
| 867 |
|
| 868 |
if ($json_api->query->ssl) { |
| 869 |
$enable_ssl = $json_api->query->ssl; |
| 870 |
} else |
| 871 |
$enable_ssl = true; |
| 872 |
|
| 873 |
if (!$json_api->query->access_token) { |
| 874 |
$json_api->error("You must include a 'access_token' variable. Get the valid access_token for this app from Facebook API."); |
| 875 |
} else { |
| 876 |
|
| 877 |
$url = 'https://graph.facebook.com/me/?fields=' . $fields . '&access_token=' . $json_api->query->access_token; |
| 878 |
|
| 879 |
// Initiate curl |
| 880 |
$ch = curl_init(); |
| 881 |
// Enable SSL verification |
| 882 |
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $enable_ssl); |
| 883 |
// Will return the response, if false it print the response |
| 884 |
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); |
| 885 |
// Set the url |
| 886 |
curl_setopt($ch, CURLOPT_URL, $url); |
| 887 |
// Execute |
| 888 |
$result = curl_exec($ch); |
| 889 |
// Closing |
| 890 |
curl_close($ch); |
| 891 |
|
| 892 |
$result = json_decode($result, true); |
| 893 |
|
| 894 |
if (isset($result["email"])) { |
| 895 |
|
| 896 |
$user_email = $result["email"]; |
| 897 |
$email_exists = email_exists($user_email); |
| 898 |
|
| 899 |
if ($email_exists) { |
| 900 |
$user = get_user_by('email', $user_email); |
| 901 |
$user_id = $user->ID; |
| 902 |
$user_name = $user->user_login; |
| 903 |
} |
| 904 |
|
| 905 |
|
| 906 |
|
| 907 |
if (!$user_id && $email_exists == false) { |
| 908 |
|
| 909 |
$user_name = strtolower($result['first_name'] . '.' . $result['last_name']); |
| 910 |
|
| 911 |
while (username_exists($user_name)) { |
| 912 |
$i++; |
| 913 |
$user_name = strtolower($result['first_name'] . '.' . $result['last_name']) . '.' . $i; |
| 914 |
|
| 915 |
} |
| 916 |
|
| 917 |
$random_password = wp_generate_password($length = 12, $include_standard_special_chars = false); |
| 918 |
$userdata = array( |
| 919 |
'user_login' => $user_name, |
| 920 |
'user_email' => $user_email, |
| 921 |
'user_pass' => $random_password, |
| 922 |
'display_name' => $result["name"], |
| 923 |
'first_name' => $result['first_name'], |
| 924 |
'last_name' => $result['last_name'] |
| 925 |
); |
| 926 |
|
| 927 |
$user_id = wp_insert_user($userdata); |
| 928 |
if ($user_id) |
| 929 |
$user_account = 'user registered.'; |
| 930 |
|
| 931 |
} else { |
| 932 |
|
| 933 |
if ($user_id) |
| 934 |
$user_account = 'user logged in.'; |
| 935 |
} |
| 936 |
|
| 937 |
$expiration = time() + apply_filters('auth_cookie_expiration', 1209600, $user_id, true); |
| 938 |
$cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in'); |
| 939 |
|
| 940 |
$response['msg'] = $user_account; |
| 941 |
$response['wp_user_id'] = $user_id; |
| 942 |
$response['cookie'] = $cookie; |
| 943 |
$response['user_login'] = $user_name; |
| 944 |
|
| 945 |
} else { |
| 946 |
$response['msg'] = "Your 'access_token' did not return email of the user. Without 'email' user can't be logged in or registered. Get user email extended permission while joining the Facebook app."; |
| 947 |
|
| 948 |
} |
| 949 |
|
| 950 |
} |
| 951 |
|
| 952 |
return $response; |
| 953 |
|
| 954 |
} |
| 955 |
|
| 956 |
public function post_comment() |
| 957 |
{ |
| 958 |
global $json_api; |
| 959 |
|
| 960 |
if (!$json_api->query->cookie) { |
| 961 |
$json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` method."); |
| 962 |
} |
| 963 |
|
| 964 |
$user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); |
| 965 |
|
| 966 |
if (!$user_id) { |
| 967 |
$json_api->error("Invalid cookie. Use the `generate_auth_cookie` method."); |
| 968 |
} |
| 969 |
|
| 970 |
if (!$json_api->query->post_id) { |
| 971 |
$json_api->error("No post specified. Include 'post_id' var in your request."); |
| 972 |
} elseif (!$json_api->query->content) { |
| 973 |
$json_api->error("Please include 'content' var in your request."); |
| 974 |
} |
| 975 |
|
| 976 |
if (!isset($json_api->query->comment_status)) { |
| 977 |
$json_api->error("Please include 'comment_status' var in your request. Possible values are comment_status=1 (approved) or comment_status=hold (not-approved)"); |
| 978 |
} else |
| 979 |
$comment_status = $json_api->query->comment_status; |
| 980 |
|
| 981 |
if ($comment_status == 'hold') |
| 982 |
$comment_status = 0; |
| 983 |
|
| 984 |
$user_info = get_userdata($user_id); |
| 985 |
|
| 986 |
$time = current_time('mysql'); |
| 987 |
$agent = $_SERVER['HTTP_USER_AGENT']; |
| 988 |
$ip = $_SERVER['REMOTE_ADDR']; |
| 989 |
|
| 990 |
$data = array( |
| 991 |
'comment_post_ID' => $json_api->query->post_id, |
| 992 |
'comment_author' => $user_info->user_login, |
| 993 |
'comment_author_email' => $user_info->user_email, |
| 994 |
'comment_author_url' => $user_info->user_url, |
| 995 |
'comment_content' => $json_api->query->content, |
| 996 |
'comment_type' => '', |
| 997 |
'comment_parent' => 0, |
| 998 |
'user_id' => $user_info->ID, |
| 999 |
'comment_author_IP' => $ip, |
| 1000 |
'comment_agent' => $agent, |
| 1001 |
'comment_date' => $time, |
| 1002 |
'comment_approved' => $comment_status, |
| 1003 |
); |
| 1004 |
|
| 1005 |
//print_r($data); |
| 1006 |
|
| 1007 |
$comment_id = wp_insert_comment($data); |
| 1008 |
|
| 1009 |
return array( |
| 1010 |
"comment_id" => $comment_id |
| 1011 |
); |
| 1012 |
} |
| 1013 |
|
| 1014 |
} |
