aboutsummaryrefslogtreecommitdiff
path: root/engine/lib/api.php
diff options
context:
space:
mode:
Diffstat (limited to 'engine/lib/api.php')
-rw-r--r--engine/lib/api.php1051
1 files changed, 604 insertions, 447 deletions
diff --git a/engine/lib/api.php b/engine/lib/api.php
index 301922636..493e2a47f 100644
--- a/engine/lib/api.php
+++ b/engine/lib/api.php
@@ -280,175 +280,200 @@ class ElggHMACCache extends ElggCache {
}
}
-// API Call functions /////////////////////////////////////////////////////////////////////
+// Primary Services API Server functions /////////////////////////////////////////////////////////////////////
/**
- * An array holding methods.
+ * A global array holding API methods.
* The structure of this is
- * $METHODS = array (
- * "api.method" => array (
+ * $API_METHODS = array (
+ * $method => array (
* "function" = 'my_function_callback'
* "call_method" = 'GET' | 'POST'
* "parameters" = array (
- * "variable" = array ( // NB, the order is the same as defined by your function callback
+ * "variable" = array ( // NB, the order should be the same as the function callback
* type => 'int' | 'bool' | 'float' | 'string'
* required => true (default) | false
* )
* )
- * "require_auth_token" => true (default) | false
+ * "require_api_auth" => true | false (default)
+ * "require_user_auth" => true | false (default)
* "description" => "Some human readable description"
* )
* )
*/
-$METHODS = array();
+$API_METHODS = array();
/**
- * Get the request method.
- */
-function get_call_method() {
- return $_SERVER['REQUEST_METHOD'];
-}
-
-/**
- * This function analyses all expected parameters for a given method, returning them in an associated array from
- * input.
+ * Expose a function as a services api call.
*
- * This ensures that they are sanitised and that no superfluous commands are registered. It also means that
- * hmacs work through the page handler.
+ * Limitations: Currently can not expose functions which expect objects.
*
- * @param string $method The method
- * @return Array containing commands and values, including method and api
+ * @param string $method The api name to expose - for example "myapi.dosomething"
+ * @param string $function Your function callback.
+ * @param array $parameters (optional) list of parameters in the same order as in your function, with optional parameters last.
+ * This array should be in the format
+ * "variable" = array (
+ * type => 'int' | 'bool' | 'float' | 'string' | 'array'
+ * required => true (default) | false
+ * )
+ * @param string $description (optional) human readable description of the function.
+ * @param string $call_method (optional) Define what http method must be used for this function. Default: GET
+ * @param bool $require_api_auth (optional) (default is false) Does this method require API authorization? (example: API key)
+ * @param bool $require_user_auth (optional) (default is false) Does this method require user authorization?
+ * @return bool
*/
-function get_parameters_for_method($method) {
- global $CONFIG, $METHODS;
+function expose_function($method, $function, array $parameters = NULL, $description = "", $call_method = "GET", $require_api_auth = false, $require_user_auth = false) {
+ global $API_METHODS;
- $method = sanitise_string($method);
- $sanitised = array();
+ if (($method == "") || ($function == "")) {
+ throw new InvalidParameterException(elgg_echo('InvalidParameterException:APIMethodOrFunctionNotSet'));
+ }
+
+ // does not check whether this method has already been exposed - good idea?
+ $API_METHODS[$method] = array();
+
+ // does not check whether callable - done in execute_method()
+ $API_METHODS[$method]["function"] = $function;
- foreach ($CONFIG->input as $k => $v) {
- if ((isset($METHODS[$method]['parameters'][$k])) || ($k == 'auth_token') || ($k == 'method')) {
- // Make things go through the sanitiser
- $sanitised[$k] = get_input($k);
+ if ($parameters != NULL && !is_array($parameters)) {
+ throw new InvalidParameterException(sprintf(elgg_echo('InvalidParameterException:APIParametersNotArray'), $method));
+ }
+
+ if ($parameters != NULL) {
+ // ensure the required flag is set correctly in default case
+ foreach ($parameters as $key => $value) {
+ if (!array_key_exists('required', $value)) {
+ $parameters[$key]['required'] = true;
+ }
}
+
+ $API_METHODS[$method]["parameters"] = $parameters;
}
- return $sanitised;
-}
-
-/**
- * Obtain a token for a user.
- *
- * @param string $username The username
- * @param string $password The password
- */
-function obtain_user_token($username, $password) {
- global $CONFIG;
+ $call_method = strtoupper($call_method);
+ switch ($call_method) {
+ case 'POST' :
+ $API_METHODS[$method]["call_method"] = 'POST';
+ break;
+ case 'GET' :
+ $API_METHODS[$method]["call_method"] = 'GET';
+ break;
+ default :
+ throw new InvalidParameterException(sprintf(elgg_echo('InvalidParameterException:UnrecognisedHttpMethod'), $call_method, $method));
+ }
- $site = $CONFIG->site_id;
- $user = get_user_by_username($username);
- $time = time();
- $time += 60*60;
- $token = md5(rand(). microtime() . $username . $password . $time . $site);
+ $API_METHODS[$method]["description"] = $description;
- if (!$user) {
- return false;
- }
+ $API_METHODS[$method]["require_api_auth"] = $require_api_auth;
- if (insert_data("INSERT into {$CONFIG->dbprefix}users_apisessions
- (user_guid, site_guid, token, expires) values
- ({$user->guid}, $site, '$token', '$time') on duplicate key update token='$token', expires='$time'")) {
- return $token;
- }
+ $API_METHODS[$method]["require_user_auth"] = $require_user_auth;
+ return true;
+}
- return false;
+/**
+ * Unregister an API method
+ * @param $method The api name that was exposed
+ */
+function unexpose_function($method) {
+ global $API_METHODS;
+
+ if (isset($API_METHODS[$method])) {
+ unset($API_METHODS[$method]);
+ }
}
/**
- * Validate a token against a given site.
- *
- * A token registered with one site can not be used from a different apikey(site), so be aware of this
- * during development.
- *
- * @param int $site The ID of the site
- * @param string $token The Token.
- * @return mixed The user id attached to the token or false.
+ * Check that the method call has the proper API and user authentication
+ * @return bool
*/
-function validate_user_token($site, $token) {
- global $CONFIG;
+function authenticate_method($method) {
+ global $API_METHODS;
+
+ // method must be exposed
+ if (!isset($API_METHODS[$method])) {
+ throw new APIException(sprintf(elgg_echo('APIException:MethodCallNotImplemented'), $method));
+ }
+
+ // make sure that POST variables are available if relevant
+ if (get_call_method() === 'POST') {
+ include_post_data();
+ }
+
+ // check API authentication if required
+ if ($API_METHODS[$method]["require_api_auth"] == true) {
+ if (api_authenticate() == false) {
+ throw new APIException(elgg_echo('APIException:APIAuthenticationFailed'));
+ }
+ }
+
+ // check user authentication if required
+ if ($API_METHODS[$method]["require_user_auth"] == true) {
+ if (pam_authenticate() == false) {
+ throw new APIException(elgg_echo('APIException:UserAuthenticationFailed'));
+ }
+ }
+
+ return true;
+}
- $site = (int)$site;
- $token = sanitise_string($token);
+$API_AUTH_HANDLERS = array();
- if (!$site) {
- throw new ConfigurationException(elgg_echo('ConfigurationException:NoSiteID'));
- }
+/**
+ * Register an API authorization handler
+ *
+ * @param $handler
+ * @param $importance
+ * @return bool
+ */
+function register_api_auth_handler($handler, $importance = "sufficient") {
+ global $API_AUTH_HANDLERS;
- $time = time();
+ if (is_callable($handler)) {
+ $API_AUTH_HANDLERS[$handler] = new stdClass;
- $user = get_data_row("SELECT * from {$CONFIG->dbprefix}users_apisessions
- where token='$token' and site_guid=$site and $time < expires");
+ $API_AUTH_HANDLERS[$handler]->handler = $handler;
+ $API_AUTH_HANDLERS[$handler]->importance = strtolower($importance);
- if ($user) {
- return $user->user_guid;
+ return true;
}
- return false;
+ return false;
}
/**
- * Expose an arbitrary function as an api call.
- *
- * Limitations: Currently can not expose functions which expect objects.
- *
- * @param string $method The api name to expose this as, eg "myapi.dosomething"
- * @param string $function Your function callback.
- * @param array $parameters Optional list of parameters in the same order as in your function, with optional parameters last.
- * This array should be in the format
- * "variable" = array (
- * type => 'int' | 'bool' | 'float' | 'string' | 'array'
- * required => true (default) | false
- * )
- * @param string $description Optional human readable description of the function.
- * @param string $call_method Define what call method should be used for this function.
- * @param bool $require_auth_token Whether this requires a user authentication token or not (default is true).
- * @param bool $anonymous Can anonymous (non-authenticated in any way) users execute this call.
+ * Authenticate an API method call
+ *
* @return bool
*/
-function expose_function($method, $function, array $parameters = NULL, $description = "", $call_method = "GET", $require_auth_token = true, $anonymous = false) {
- global $METHODS;
-
- if (($method!="") && ($function!="")) {
- $METHODS[$method] = array();
+function api_authenticate() {
+ global $API_AUTH_HANDLERS;
- $METHODS[$method]["function"] = $function;
+ $authenticated = false;
- if ($parameters!=NULL) {
- $METHODS[$method]["parameters"] = $parameters;
- }
+ foreach ($API_AUTH_HANDLERS as $k => $v) {
+ $handler = $v->handler;
+ $importance = $v->importance;
- $call_method = strtoupper($call_method);
- switch ($call_method) {
- case 'POST' :
- $METHODS[$method]["call_method"] = 'POST';
- break;
- case 'GET' :
- $METHODS[$method]["call_method"] = 'GET';
- break;
- default :
- throw new InvalidParameterException(sprintf(elgg_echo('InvalidParameterException:UnrecognisedMethod'), $method));
+ try {
+ // Execute the handler
+ if ($handler()) {
+ $authenticated = true;
+ } else {
+ // If this is required then abort.
+ if ($importance == 'required') {
+ return false;
+ }
+ }
+ } catch (Exception $e) {
+ // If this is required then abort.
+ if ($importance == 'required') {
+ return false;
+ }
}
-
- $METHODS[$method]["description"] = $description;
-
- $METHODS[$method]["require_auth_token"] = $require_auth_token;
-
- $METHODS[$method]["anonymous"] = $anonymous;
-
- return true;
}
- return false;
+ return $authenticated;
}
/**
@@ -456,165 +481,375 @@ function expose_function($method, $function, array $parameters = NULL, $descript
* A method is a function which you have previously exposed using expose_function.
*
* @param string $method Method, e.g. "foo.bar"
- * @param array $parameters Array of parameters in the format "variable" => "value", thse will be sanitised before being fed to your handler.
- * @param string $token The authentication token to authorise this method call.
* @return GenericResult The result of the execution.
* @throws APIException, SecurityException
*/
-function execute_method($method, array $parameters, $token = "") {
- global $METHODS, $CONFIG;
+function execute_method($method) {
+ global $API_METHODS, $CONFIG;
- // Sanity check
- $method = sanitise_string($method);
- $token = sanitise_string($token);
+ // method must be exposed
+ if (!isset($API_METHODS[$method])) {
+ throw new APIException(sprintf(elgg_echo('APIException:MethodCallNotImplemented'), $method));
+ }
- // See if we can find the method handler
- if ((isset($METHODS[$method]["function"])) && (is_callable($METHODS[$method]["function"]))) {
- // See if this is being made with the right call method
- if (strcmp(get_call_method(), $METHODS[$method]["call_method"])==0) {
- $serialised_parameters = "";
-
- // If we have parameters then we need to sanitise the parameters.
- if ((isset($METHODS[$method]["parameters"])) && (is_array($METHODS[$method]["parameters"]))) {
- foreach ($METHODS[$method]["parameters"] as $key => $value) {
-
- if ((is_array($value)) && (isset($value['type']))) {
- // Check that the variable is present in the request
- if ((!isset($parameters[$key]))
- || ((!isset($value['required']))
- || ($value['required']==true))) {
- throw new APIException(sprintf(elgg_echo('APIException:MissingParameterInMethod'), $key, $method));
- } else {
- // Avoid debug error
- if (isset($parameters[$key])) {
- // Set variables casting to type.
- switch (strtolower($value['type'])) {
- case 'int':
- case 'integer' :
- $serialised_parameters .= "," . (int)trim($parameters[$key]); break;
- case 'bool':
- case 'boolean':
- if (strcasecmp(trim($parameters[$key]), "false")==0) {
- $parameters[$key]='';
- }
-
- $serialised_parameters .= "," . (bool)trim($parameters[$key]);
- break;
- case 'string':
- $serialised_parameters .= ",'" . (string)mysql_real_escape_string(trim($parameters[$key])) . "'";
- break;
- case 'float':
- $serialised_parameters .= "," . (float)trim($parameters[$key]);
- break;
- case 'array':
- $array = "array(";
-
- if (is_array($parameters[$key])) {
- foreach ($parameters[$key] as $k => $v) {
- $k = sanitise_string($k);
- $v = sanitise_string($v);
-
- $array .= "'$k'=>'$v',";
- }
-
- $array = trim($array,",");
- } else {
- throw APIException(sprintf(elgg_echo('APIException:ParameterNotArray'), $key));
- }
-
- $array .= ")";
-
- $serialised_parameters .= $array;
- break;
-
- default :
- throw new APIException(sprintf(elgg_echo('APIException:UnrecognisedTypeCast'), $value['type'], $key, $method));
- }
- }
- }
- } else {
- throw new APIException(sprintf(elgg_echo('APIException:InvalidParameter'), $key, $method));
- }
- }
- }
+ // function must be callable
+ if (!(isset($API_METHODS[$method]["function"])) || !(is_callable($API_METHODS[$method]["function"]))) {
+ throw new APIException(sprintf(elgg_echo('APIException:MethodCallNotImplemented'), $method));
+ }
+
+ // check http call method
+ if (strcmp(get_call_method(), $API_METHODS[$method]["call_method"]) != 0) {
+ throw new CallException(sprintf(elgg_echo('CallException:InvalidCallMethod'), $method, $API_METHODS[$method]["call_method"]));
+ }
+
+ $parameters = get_parameters_for_method($method);
+
+ if (verify_parameters($method, $parameters) == false) {
+ // error
+ return false;
+ }
+
+ $serialised_parameters = serialise_parameters($method, $parameters);
+
+ // Execute function: Construct function and calling parameters
+ $function = $API_METHODS[$method]["function"];
+ $serialised_parameters = trim($serialised_parameters, ", ");
+
+ $result = eval("return $function($serialised_parameters);");
+
+ // Sanity check result
+ // If this function returns an api result itself, just return it
+ if ($result instanceof GenericResult) {
+ return $result;
+ }
- // Execute function: Construct function and calling parameters
- $function = $METHODS[$method]["function"];
- $serialised_parameters = trim($serialised_parameters, ", ");
+ if ($result === false) {
+ throw new APIException(sprintf(elgg_echo('APIException:FunctionParseError'), $function, $serialised_parameters));
+ }
- $result = eval("return $function($serialised_parameters);");
+ if ($result === NULL) {
+ // If no value
+ throw new APIException(sprintf(elgg_echo('APIException:FunctionNoReturn'), $function, $serialised_parameters));
+ }
- // Sanity check result
- // If this function returns an api result itself, just return it
- if ($result instanceof GenericResult) {
- return $result;
- }
+ // Otherwise assume that the call was successful and return it as a success object.
+ return SuccessResult::getInstance($result);
+}
- if ($result === FALSE) {
- throw new APIException(sprintf(elgg_echo('APIException:FunctionParseError'), $function, $serialised_parameters));
- }
+/**
+ * Get the request method.
+ */
+function get_call_method() {
+ return $_SERVER['REQUEST_METHOD'];
+}
+
+/**
+ * This function analyses all expected parameters for a given method
+ *
+ * This function sanitizes the input parameters and returns them in
+ * an associated array.
+ *
+ * @param string $method The method
+ * @return array containing parameters as key => value
+ */
+function get_parameters_for_method($method) {
+ global $API_METHODS;
- if ($result === NULL) {
- // If no value
- throw new APIException(sprintf(elgg_echo('APIException:FunctionNoReturn'), $function, $serialised_parameters));
+ $sanitised = array();
+
+ // if there are parameters, sanitize them
+ if (isset($API_METHODS[$method]['parameters'])) {
+ foreach ($API_METHODS[$method]['parameters'] as $k => $v) {
+ $v = get_input($k); // Make things go through the sanitiser
+ if ($v !== '') {
+ $sanitised[$k] = $v;
}
+ }
+ }
+
+ return $sanitised;
+}
+
- // Otherwise assume that the call was successful and return it as a success object.
- return SuccessResult::getInstance($result);
+function get_post_data() {
+ global $GLOBALS;
+
+ $postdata = '';
+ if (isset($GLOBALS['HTTP_RAW_POST_DATA']))
+ $postdata = $GLOBALS['HTTP_RAW_POST_DATA'];
+
+ // Attempt another method to return post data (incase always_populate_raw_post_data is switched off)
+ if (!$postdata) {
+ $postdata = file_get_contents('php://input');
+ }
+
+ return $postdata;
+}
- } else {
- throw new CallException(sprintf(elgg_echo('CallException:InvalidCallMethod'), $method, $METHODS[$method]["call_method"]));
+/**
+ * This fixes the post parameters that are munged due to page handler
+ */
+function include_post_data() {
+
+ $postdata = get_post_data();
+
+ if (isset($postdata)) {
+ parse_str($postdata, $query_arr);
+ if (is_array($query_arr)) {
+ foreach($query_arr as $name => $val) {
+ set_input($name, $val);
+ }
}
}
+}
- // Return an error if not found
- throw new APIException(sprintf(elgg_echo('APIException:MethodCallNotImplemented'), $method));
+/**
+ * Verify that the required parameters are present
+ * @param $method
+ * @param $parameters
+ * @return true on success or exception
+ */
+function verify_parameters($method, $parameters) {
+ global $API_METHODS;
+
+ // are there any parameters for this method
+ if (!(isset($API_METHODS[$method]["parameters"]))) {
+ return true; // no so return
+ }
+
+ // check that the parameters were registered correctly and all required ones are there
+ foreach ($API_METHODS[$method]['parameters'] as $key => $value) {
+ // must be array to describe parameter in expose and type must be defined
+ if (!is_array($value) || !isset($value['type'])) {
+ throw new APIException(sprintf(elgg_echo('APIException:InvalidParameter'), $key, $method));
+ }
+
+ // Check that the variable is present in the request if required
+ $is_param_required = !isset($value['required']) || $value['required'];
+ if ($is_param_required && !array_key_exists($key, $parameters)) {
+ throw new APIException(sprintf(elgg_echo('APIException:MissingParameterInMethod'), $key, $method));
+ }
+ }
+
+ return true;
}
-// System functions ///////////////////////////////////////////////////////////////////////
+/**
+ * Serialize an array of parameters for an API method call
+ *
+ * @param $method
+ * @param $parameters
+ * @return unknown_type
+ */
+function serialise_parameters($method, $parameters) {
+ global $API_METHODS;
+
+ // are there any parameters for this method
+ if (!(isset($API_METHODS[$method]["parameters"]))) {
+ return ''; // if not, return
+ }
+
+ $serialised_parameters = "";
+ foreach ($API_METHODS[$method]['parameters'] as $key => $value) {
+
+ // avoid warning on parameters that are not required and not present
+ if (!isset($parameters[$key])) {
+ continue;
+ }
+
+ // Set variables casting to type.
+ switch (strtolower($value['type']))
+ {
+ case 'int':
+ case 'integer' :
+ $serialised_parameters .= "," . (int)trim($parameters[$key]);
+ break;
+ case 'bool':
+ case 'boolean':
+ // change word false to boolean false
+ if (strcasecmp(trim($parameters[$key]), "false") == 0) {
+ $parameters[$key] = false;
+ }
+
+ $serialised_parameters .= "," . (bool)trim($parameters[$key]);
+ break;
+ case 'string':
+ $serialised_parameters .= ",'" . (string)mysql_real_escape_string(trim($parameters[$key])) . "'";
+ break;
+ case 'float':
+ $serialised_parameters .= "," . (float)trim($parameters[$key]);
+ break;
+ case 'array':
+ // we can handle an array of strings, maybe ints, definitely not booleans or other arrays
+ $array = "array(";
+ if (!is_array($parameters[$key]))
+ {
+ throw APIException(sprintf(elgg_echo('APIException:ParameterNotArray'), $key));
+ }
+
+ foreach ($parameters[$key] as $k => $v)
+ {
+ $k = sanitise_string($k);
+ $v = sanitise_string($v);
+
+ $array .= "'$k'=>'$v',";
+ }
+
+ $array = trim($array,",");
+
+ $array .= ")";
+
+ $serialised_parameters .= $array;
+ break;
+ default:
+ throw new APIException(sprintf(elgg_echo('APIException:UnrecognisedTypeCast'), $value['type'], $key, $method));
+ }
+ }
+
+ return $serialised_parameters;
+}
+
+// API authorization handlers /////////////////////////////////////////////////////////////////////
/**
- * Simple api to return a list of all api's installed on the system.
+ * Confirm that the call includes a valid API key
+ * @return true if good API key - otherwise throws exception
*/
-function list_all_apis() {
- global $METHODS;
- return $METHODS;
+function api_auth_key() {
+ global $CONFIG;
+
+ // check that an API key is present
+ $api_key = get_input('api_key');
+ if ($api_key == "") {
+ throw new APIException(elgg_echo('APIException:MissingAPIKey'));
+ }
+
+ // check that it is active
+ $api_user = get_api_user($CONFIG->site_id, $api_key);
+ if (!$api_user) {
+ throw new APIException(elgg_echo('APIException:MissingAPIKey'));
+ }
+
+ return trigger_plugin_hook('api_key', 'use', $api_key, true);
}
-// Expose some system api functions
-expose_function("system.api.list", "list_all_apis", NULL, elgg_echo("system.api.list"), "GET", false);
/**
- * The auth.gettoken API.
- * This API call lets a user log in, returning an authentication token which can be used
- * in leu of a username and password login from then on.
- *
- * @param string username Username
- * @param string password Clear text password
+ *
+ * @return true if success - otherwise throws exception
*/
-function auth_gettoken($username, $password) {
- if (authenticate($username, $password)) {
- $token = obtain_user_token($username, $password);
- if ($token) {
- return $token;
+function api_auth_hmac() {
+ global $CONFIG;
+
+ // Get api header
+ $api_header = get_and_validate_api_headers();
+
+ // Pull API user details
+ $api_user = get_api_user($CONFIG->site_id, $api_header->api_key);
+
+ if (!$api_user) {
+ throw new SecurityException(elgg_echo('SecurityException:InvalidAPIKey'), ErrorResult::$RESULT_FAIL_APIKEY_INVALID);
+ }
+
+ // Get the secret key
+ $secret_key = $api_user->secret;
+
+ // get the query string
+ $query = substr($_SERVER['REQUEST_URI'], strpos($_SERVER['REQUEST_URI'], '?') + 1);
+
+ // calculate expected HMAC
+ $hmac = calculate_hmac( $api_header->hmac_algo,
+ $api_header->time,
+ $api_header->api_key,
+ $secret_key,
+ $params,
+ $api_header->method == 'POST' ? $api_header->posthash : "");
+
+
+ if (!(strcmp($api_header->hmac, $hmac) == 0) && !($api_header->hmac) && !($hmac)) {
+ throw new SecurityException("HMAC is invalid. {$api_header->hmac} != [calc]$hmac");
+ }
+
+ // Now make sure this is not a replay
+ if (cache_hmac_check_replay($hmac)) {
+ throw new SecurityException(elgg_echo('SecurityException:DupePacket'));
+ }
+
+ // Validate post data
+ if ($api_header->method=="POST") {
+ $postdata = get_post_data();
+ $calculated_posthash = calculate_posthash($postdata, $api_header->posthash_algo);
+
+ if (strcmp($api_header->posthash, $calculated_posthash)!=0) {
+ throw new SecurityException(sprintf(elgg_echo('SecurityException:InvalidPostHash'), $calculated_posthash, $api_header->posthash));
}
}
- throw new SecurityException(elgg_echo('SecurityException:authenticationfailed'));
+ return true;
}
-// The authentication token api
-expose_function("auth.gettoken", "auth_gettoken", array(
- "username" => array (
- 'type' => 'string'
- ),
- "password" => array (
- 'type' => 'string'
- )
-), elgg_echo('auth.gettoken'), "GET", false, false);
+// HMAC /////////////////////////////////////////////////////////////////////
+/**
+ * This function looks at the super-global variable $_SERVER and extracts the various
+ * header variables needed to pass to the validation functions after performing basic validation.
+ *
+ * @return stdClass Containing all the values.
+ * @throws APIException Detailing any error.
+ */
+function get_and_validate_api_headers() {
+ $result = new stdClass;
-// PAM AUTH HMAC functions ////////////////////////////////////////////////////////////////
+ $result->method = get_call_method();
+ // Only allow these methods
+ if (($result->method != "GET") && ($result->method != "POST")) {
+ throw new APIException(elgg_echo('APIException:NotGetOrPost'));
+ }
+
+ $result->api_key = $_SERVER['HTTP_X_ELGG_APIKEY'];
+ if ($result->api_key == "") {
+ throw new APIException(elgg_echo('APIException:MissingAPIKey'));
+ }
+
+ $result->hmac = $_SERVER['HTTP_X_ELGG_HMAC'];
+ if ($result->hmac == "") {
+ throw new APIException(elgg_echo('APIException:MissingHmac'));
+ }
+
+ $result->hmac_algo = $_SERVER['HTTP_X_ELGG_HMAC_ALGO'];
+ if ($result->hmac_algo == "") {
+ throw new APIException(elgg_echo('APIException:MissingHmacAlgo'));
+ }
+
+ $result->time = $_SERVER['HTTP_X_ELGG_TIME'];
+ if ($result->time == "") {
+ throw new APIException(elgg_echo('APIException:MissingTime'));
+ }
+
+ // Basic timecheck, think about making this smaller if we get loads of users and the cache gets really big.
+ if (($result->time<(microtime(true)-86400.00)) || ($result->time>(microtime(true)+86400.00))) {
+ throw new APIException(elgg_echo('APIException:TemporalDrift'));
+ }
+
+ if ($result->method == "POST") {
+ $result->posthash = $_SERVER['HTTP_X_ELGG_POSTHASH'];
+ if ($result->posthash == "") {
+ throw new APIException(elgg_echo('APIException:MissingPOSTHash'));
+ }
+
+ $result->posthash_algo = $_SERVER['HTTP_X_ELGG_POSTHASH_ALGO'];
+ if ($result->posthash_algo == "") {
+ throw new APIException(elgg_echo('APIException:MissingPOSTAlgo'));
+ }
+
+ $result->content_type = $_SERVER['CONTENT_TYPE'];
+ if ($result->content_type == "") {
+ throw new APIException(elgg_echo('APIException:MissingContentType'));
+ }
+ }
+
+ return $result;
+}
/**
* Map various algorithms to their PHP equivs.
@@ -707,6 +942,8 @@ function cache_hmac_check_replay($hmac) {
return true;
}
+// API key functions /////////////////////////////////////////////////////////////////////
+
/**
* Find an API User's details based on the provided public api key. These users are not users in the traditional sense.
*
@@ -764,105 +1001,20 @@ function create_api_user($site_guid) {
return false;
}
-/**
- * This function looks at the super-global variable $_SERVER and extracts the various
- * header variables needed to pass to the validation functions after performing basic validation.
- *
- * @return stdClass Containing all the values.
- * @throws APIException Detailing any error.
- */
-function get_and_validate_api_headers() {
- $result = new stdClass;
-
- $result->method = get_call_method();
- // Only allow these methods
- if (($result->method != "GET") && ($result->method!= "POST")) {
- throw new APIException(elgg_echo('APIException:NotGetOrPost'));
- }
-
- $result->api_key = $_SERVER['HTTP_X_ELGG_APIKEY'];
- if ($result->api_key == "") {
- throw new APIException(elgg_echo('APIException:MissingAPIKey'));
- }
-
- $result->hmac = $_SERVER['HTTP_X_ELGG_HMAC'];
- if ($result->hmac == "") {
- throw new APIException(elgg_echo('APIException:MissingHmac'));
- }
-
- $result->hmac_algo = $_SERVER['HTTP_X_ELGG_HMAC_ALGO'];
- if ($result->hmac_algo == "") {
- throw new APIException(elgg_echo('APIException:MissingHmacAlgo'));
- }
-
- $result->time = $_SERVER['HTTP_X_ELGG_TIME'];
- if ($result->time == "") {
- throw new APIException(elgg_echo('APIException:MissingTime'));
- }
-
- // Basic timecheck, think about making this smaller if we get loads of users and the cache gets really big.
- if (($result->time<(microtime(true)-86400.00)) || ($result->time>(microtime(true)+86400.00))) {
- throw new APIException(elgg_echo('APIException:TemporalDrift'));
- }
-
- //$_SERVER['QUERY_STRING'];
- $result->get_variables = get_parameters_for_method(get_input('method'));
- if ($result->get_variables == "") {
- throw new APIException(elgg_echo('APIException:NoQueryString'));
- }
-
- if ($result->method=="POST") {
- $result->posthash = $_SERVER['HTTP_X_ELGG_POSTHASH'];
- if ($result->posthash == "") {
- throw new APIException(elgg_echo('APIException:MissingPOSTHash'));
- }
-
- $result->posthash_algo = $_SERVER['HTTP_X_ELGG_POSTHASH_ALGO'];
- if ($result->posthash_algo == "") {
- throw new APIException(elgg_echo('APIException:MissingPOSTAlgo'));
- }
-
- $result->content_type = $_SERVER['CONTENT_TYPE'];
- if ($result->content_type == "") {
- throw new APIException(elgg_echo('APIException:MissingContentType'));
- }
- }
-
- return $result;
-}
+// User Authorization functions ////////////////////////////////////////////////////////////////
/**
- * Return a sanitised form of the POST data sent to the script
- *
- * @return string
- */
-function get_post_data() {
- global $GLOBALS;
-
- $postdata = $GLOBALS['HTTP_RAW_POST_DATA'];
-
- // Attempt another method to return post data (incase always_populate_raw_post_data is switched off)
- if (!$postdata) {
- $postdata = file_get_contents('php://input');
- }
-
- return $postdata;
-}
-
-// PAM functions //////////////////////////////////////////////////////////////////////////
-
-/**
- * Function that examines whether an authentication token is present returning true if it is, OR the requested
- * method doesn't require one.
- *
- * If a token is present and a validated user id is returned, that user is logged in to the current session.
+ * Check the user token
+ * This examines whether an authentication token is present and returns true if
+ * it is present and is valid. The user gets logged in so with the current
+ * session code of Elgg, that user will be logged out of all other sessions.
*
* @param unknown_type $credentials
+ * @return bool
*/
function pam_auth_usertoken($credentials = NULL) {
- global $METHODS, $CONFIG;
+ global $CONFIG;
- $method = get_input('method');
$token = get_input('auth_token');
$validated_userid = validate_user_token($CONFIG->site_id, $token);
@@ -889,28 +1041,7 @@ function pam_auth_usertoken($credentials = NULL) {
if (!login($u)) {
return false;
}
- }
-
- if ((!$METHODS[$method]["require_auth_token"]) || ($validated_userid) || (isloggedin())) {
- return true;
- } else {
- throw new SecurityException(elgg_echo('SecurityException:AuthTokenExpired'), ErrorResult::$RESULT_FAIL_AUTHTOKEN);
- }
-
- return false;
-}
-
-/**
- * Test to see whether a given function has been declared as anonymous access (it doesn't require any auth token)
- *
- * @param unknown_type $credentials
- */
-function pam_auth_anonymous_method($credentials = NULL) {
- global $METHODS, $CONFIG;
-
- $method = get_input('method');
-
- if ((isset($METHODS[$method]["anonymous"])) && ($METHODS[$method]["anonymous"])) {
+
return true;
}
@@ -925,80 +1056,60 @@ function pam_auth_session($credentials = NULL) {
}
/**
- * Secure authentication through headers and HMAC.
+ * Obtain a token for a user.
+ *
+ * @param string $username The username
+ * @param string $password The password
*/
-function pam_auth_hmac($credentials = NULL) {
+function obtain_user_token($username, $password) {
global $CONFIG;
- // Get api header
- $api_header = get_and_validate_api_headers();
-
- // Pull API user details
- $api_user = get_api_user($CONFIG->site_id, $api_header->api_key);
-
- if ($api_user) {
- // Get the secret key
- $secret_key = $api_user->secret;
-
- // Serialise parameters
- $encoded_params = array();
- foreach ($api_header->get_variables as $k => $v) {
- $encoded_params[] = urlencode($k).'='.urlencode($v);
- }
- $params = implode('&', $encoded_params);
-
- // Validate HMAC
- $hmac = calculate_hmac($api_header->hmac_algo,
- $api_header->time,
- $api_header->api_key,
- $secret_key,
- $params,
- $api_header->method == 'POST' ? $api_header->posthash : "");
-
- if ((strcmp($api_header->hmac, $hmac) == 0) && ($api_header->hmac) && ($hmac)) {
- // Now make sure this is not a replay
- if (!cache_hmac_check_replay($hmac)) {
-
- // Validate post data
- if ($api_header->method=="POST") {
- $postdata = get_post_data();
- $calculated_posthash = calculate_posthash($postdata, $api_header->posthash_algo);
+ $site = $CONFIG->site_id;
+ $user = get_user_by_username($username);
+ $time = time();
+ $time += 60*60; // token is good for one hour
+ $token = md5(rand(). microtime() . $username . $password . $time . $site);
- if (strcmp($api_header->posthash, $calculated_posthash)!=0) {
- throw new SecurityException(sprintf(elgg_echo('SecurityException:InvalidPostHash'), $calculated_posthash, $api_header->posthash));
- }
- }
+ if (!$user) {
+ return false;
+ }
- // If we've passed all the checks so far then we can be reasonably certain that the request is authentic, so return this fact to the PAM engine.
- return true;
- } else {
- throw new SecurityException(elgg_echo('SecurityException:DupePacket'));
- }
- } else {
- throw new SecurityException("HMAC is invalid. {$api_header->hmac} != [calc]$hmac = {$api_header->hmac_algo}(**SECRET KEY**, time:{$api_header->time}, apikey:{$api_header->api_key}, get_vars:{$params}" . ($api_header->method=="POST"? "posthash:$api_header->posthash}" : ")"));
- }
- } else {
- throw new SecurityException(elgg_echo('SecurityException:InvalidAPIKey'),ErrorResult::$RESULT_FAIL_APIKEY_INVALID);
+ if (insert_data("INSERT into {$CONFIG->dbprefix}users_apisessions
+ (user_guid, site_guid, token, expires) values
+ ({$user->guid}, $site, '$token', '$time') on duplicate key update token='$token', expires='$time'")) {
+ return $token;
}
return false;
}
/**
- * A bit of a hack. Basically, this combines session and hmac, so that one of them must evaluate to true in order
- * to proceed.
+ * Validate a token against a given site.
*
- * This ensures that this and auth_token are evaluated separately.
+ * A token registered with one site can not be used from a different apikey(site), so be aware of this
+ * during development.
*
- * @param unknown_type $credentials
+ * @param int $site The ID of the site
+ * @param string $token The Token.
+ * @return mixed The user id attached to the token or false.
*/
-function pam_auth_session_or_hmac($credentials = NULL) {
- if (pam_auth_session($credentials)) {
- return true;
+function validate_user_token($site, $token) {
+ global $CONFIG;
+
+ $site = (int)$site;
+ $token = sanitise_string($token);
+
+ if (!$site) {
+ throw new ConfigurationException(elgg_echo('ConfigurationException:NoSiteID'));
}
- if (pam_auth_hmac($credentials)) {
- return true;
+ $time = time();
+
+ $user = get_data_row("SELECT * from {$CONFIG->dbprefix}users_apisessions
+ where token='$token' and site_guid=$site and $time < expires");
+
+ if ($user) {
+ return $user->user_guid;
}
return false;
@@ -1006,10 +1117,6 @@ function pam_auth_session_or_hmac($credentials = NULL) {
// Client api functions ///////////////////////////////////////////////////////////////////
-$APICLIENT_LAST_CALL = NULL;
-$APICLIENT_LAST_CALL_RAW = "";
-$APICLIENT_LAST_ERROR = NULL;
-
/**
* Utility function to serialise a header array into its text representation.
*
@@ -1038,7 +1145,7 @@ function serialise_api_headers(array $headers) {
* @return stdClass The unserialised response object
*/
function send_api_call(array $keys, $url, array $call, $method = 'GET', $post_data = '', $content_type = 'application/octet-stream') {
- global $APICLIENT_LAST_CALL, $APICLIENT_LAST_CALL_RAW, $APICLIENT_LAST_ERROR, $CONFIG;
+ global $CONFIG;
$headers = array();
$encoded_params = array();
@@ -1114,15 +1221,9 @@ function send_api_call(array $keys, $url, array $call, $method = 'GET', $post_da
// Send the query and get the result and decode.
elgg_log("APICALL: $url");
- $APICLIENT_LAST_CALL_RAW = file_get_contents($url, false, $context);
+ $results = file_get_contents($url, false, $context);
- $APICLIENT_LAST_CALL = unserialize($APICLIENT_LAST_CALL_RAW);
-
- if (($APICLIENT_LAST_CALL) && ($APICLIENT_LAST_CALL->status!=0)) {
- $APICLIENT_LAST_ERROR = $APICLIENT_LAST_CALL;
- }
-
- return $APICLIENT_LAST_CALL;
+ return $results;
}
/**
@@ -1158,7 +1259,40 @@ function send_api_post_call($url, array $call, array $keys, $post_data, $content
* @param string $api_key Your api key
*/
function get_standard_api_key_array($secret_key, $api_key) {
- return array('public' => $api_key, 'private' => $api_key);
+ return array('public' => $api_key, 'private' => $secret_key);
+}
+
+// System functions ///////////////////////////////////////////////////////////////////////
+
+/**
+ * Simple api to return a list of all api's installed on the system.
+ */
+function list_all_apis() {
+ global $API_METHODS;
+
+ // sort first
+ ksort($API_METHODS);
+
+ return $API_METHODS;
+}
+
+/**
+ * The auth.gettoken API.
+ * This API call lets a user log in, returning an authentication token which can be used
+ * in leu of a username and password login from then on.
+ *
+ * @param string username Username
+ * @param string password Clear text password
+ */
+function auth_gettoken($username, $password) {
+ if (authenticate($username, $password)) {
+ $token = obtain_user_token($username, $password);
+ if ($token) {
+ return $token;
+ }
+ }
+
+ throw new SecurityException(elgg_echo('SecurityException:authenticationfailed'));
}
// Error handler functions ////////////////////////////////////////////////////////////////
@@ -1214,25 +1348,13 @@ function __php_api_exception_handler($exception) {
error_log("*** FATAL EXCEPTION (API) *** : " . $exception);
- page_draw($exception->getMessage(), elgg_view("api/output",
- array('result' => ErrorResult::getInstance(
- $exception->getMessage(),
- $exception->getCode() == 0 ? ErrorResult::$RESULT_FAIL : $exception->getCode(),
- $exception)
- ))
- );
+ $code = $exception->getCode() == 0 ? ErrorResult::$RESULT_FAIL : $exception->getCode();
+ $result = new ErrorResult($exception->getMessage(), $code, NULL);
+
+ page_draw($exception->getMessage(), elgg_view("api/output", array("result" => $result)));
}
-// Initialisation & pagehandler ///////////////////////////////////////////////////////////
-
-/**
- * Initialise the API subsystem.
- *
- */
-function api_init() {
- // Register a page handler, so we can have nice URLs
- register_page_handler('api','api_endpoint_handler');
-}
+// Initialisation /////////////////////////////////////////////////////////////
/**
* Register a page handler for the various API endpoints.
@@ -1256,4 +1378,39 @@ function api_endpoint_handler($page) {
}
}
+/**
+ * Unit tests for API
+ */
+function api_unit_test($hook, $type, $value, $params) {
+ global $CONFIG;
+ $value[] = $CONFIG->path . 'engine/tests/services/api.php';
+ return $value;
+}
+
+/**
+ * Initialise the API subsystem.
+ *
+ */
+function api_init() {
+ // Register a page handler, so we can have nice URLs
+ register_page_handler('api','api_endpoint_handler');
+
+ register_plugin_hook('unit_test', 'system', 'api_unit_test');
+
+ // expose the list of api methods
+ expose_function("system.api.list", "list_all_apis", NULL, elgg_echo("system.api.list"), "GET", false, false);
+
+ // The authentication token api
+ expose_function("auth.gettoken",
+ "auth_gettoken", array(
+ 'username' => array ('type' => 'string'),
+ 'password' => array ('type' => 'string'),
+ ),
+ elgg_echo('auth.gettoken'),
+ 'POST',
+ false,
+ false);
+}
+
+
register_elgg_event_handler('init','system','api_init');