aboutsummaryrefslogtreecommitdiff
path: root/engine/lib
diff options
context:
space:
mode:
Diffstat (limited to 'engine/lib')
-rw-r--r--engine/lib/api.php129
-rw-r--r--engine/lib/users.php3
2 files changed, 123 insertions, 9 deletions
diff --git a/engine/lib/api.php b/engine/lib/api.php
index b446c5d63..0e9260629 100644
--- a/engine/lib/api.php
+++ b/engine/lib/api.php
@@ -162,8 +162,7 @@
/** Create the environment for API Calls */
$ApiEnvironment = new stdClass;
-
-
+
/**
* An array holding methods.
* The structure of this is
@@ -182,8 +181,22 @@
*/
$METHODS = array();
+ /**
+ * Validate a token against a given site.
+ *
+ * A token registered with one site can not be used from a different apikey(site), so be aware of this
+ * during development.
+ *
+ * @param int $site The ID of the site
+ * @param string $token The Token.
+ * @return mixed The user id attached to the token or false.
+ */
+ function validate_user_token($site, $token)
+ {
+ $u = new User();
- // export function
+ return $u->getUserIDFromAuthToken($site, $token);
+ }
/**
* Expose an arbitrary function as an api call.
@@ -198,6 +211,26 @@
*/
function expose_function($method, $function, array $parameters = NULL, $require_auth = true)
{
+ global $METHODS;
+
+ if (
+ ($method!="") &&
+ ($function!="")
+ )
+ {
+ $METHODS[$method] = array();
+
+ $METHODS[$method]["function"] = $function;
+
+ if ($parameters!=NULL)
+ $METHODS[$method]["parameters"] = $parameters;
+
+ $METHODS[$method]["require_auth"] = $require_auth;
+
+ return true;
+ }
+
+ return false;
}
/**
@@ -212,9 +245,91 @@
*/
function execute_method($method, array $parameters, $token = "")
{
-
- // TODO: If auth token, validate user and set session
+ global $METHODS, $ApiEnvironment;
+ // Sanity check
+ $method = trim($method);
+ $token = trim($token);
+
+ // See if we can find the method handler
+ if (is_callable($METHODS[$method]["function"]))
+ {
+ $serialised_parameters = "";
+
+ $validated_userid = validate_user_token($ApiEnvironment->site_id, $token);
+
+ if ((!$METHODS[$method]["require_auth"]) || ($validated_userid) || (isloggedin()))
+ {
+ // If we have parameters then we need to sanitise the parameters.
+ if ((isset($METHODS[$method]["parameters"])) && (is_array($METHODS[$method]["parameters"])))
+ {
+ foreach ($METHODS[$method]["parameters"] as $key => $value)
+ {
+ if (
+ (is_array($value)) // Check that this is an array
+ && (isset($value['type'])) // Check we have a type defined
+ )
+ {
+ // Check that the variable is present in the request
+
+ if (
+ (!isset($parameters[$key])) && // No parameter
+ ((!isset($value['required'])) || ($value['required']!=true)) // and not optional
+ )
+ throw new APIException("Missing parameter $key in method $method");
+ else
+ {
+ // Avoid debug error
+ if (isset($parameters[$key]))
+ {
+ // Set variables casting to type.
+ switch (strtolower($value['type']))
+ {
+ case 'int':
+ case 'integer' : $serialised_parameters .= "," . (int)trim($parameters[$key]); break;
+ case 'bool':
+ case 'boolean':
+ if (strcasecmp(trim($parameters[$key]), "false")==0)
+ $parameters[$key]='';
+
+ $serialised_parameters .= "," . (bool)trim($parameters[$key]);
+ break;
+ case 'string': $serialised_parameters .= ",'" . (string)mysql_real_escape_string(trim($parameters[$key])) . "'";
+ break;
+ case 'float': $serialised_parameters .= "," . (float)trim($parameters[$key]);
+ break;
+
+ default : throw new APIException("Unrecognised type in cast {$value['type']} for variable '$key' in method '$method'");
+ }
+ }
+ }
+ }
+ else
+ throw new APIException("Invalid parameter found for '$key' in method '$method'.");
+ }
+ }
+
+ // Execute function: Construct function and calling parameters
+ $function = $METHODS[$method]["function"];
+ $serialised_parameters = trim($serialised_parameters, ", ");
+
+ $result = eval("return $function($serialised_parameters);");
+
+ // Sanity check result
+ if ($result instanceof GenericResult) // If this function returns an api result itself, just return it
+ return $result;
+
+ if ($result === FALSE)
+ throw new APIException("$function($serialised_parameters) has a parsing error.");
+
+ if ($result === NULL)
+ throw new APIException("$function($serialised_parameters) returned no value."); // If no value
+
+ return SuccessResult::getInstance($result); // Otherwise assume that the call was successful and return it as a success object.
+ }
+ else
+ throw new SecurityException("Authentication token either missing, invalid or expired.", GenericResult::$RESULT_FAIL_AUTHTOKEN);
+ }
// Return an error if not found
throw new APIException("Method call '$method' has not been implemented.");
@@ -227,7 +342,7 @@
* @return stdClass Containing all the values.
* @throws APIException Detailing the error.
*/
- function get_and_validate_api_headers()
+ function get_and_validate_api_headers()
{
$result = new stdClass;
@@ -351,8 +466,6 @@
return true;
}
-
-
// XML functions //////////////////////////////////////////////////////////////////////////
/**
diff --git a/engine/lib/users.php b/engine/lib/users.php
index 6003be706..24ded8ce5 100644
--- a/engine/lib/users.php
+++ b/engine/lib/users.php
@@ -708,7 +708,8 @@
setcookie("elggperm", $code, (time()+(86400 * 30)),"/");
//}
- // set_login_fields($user->id);
+ // set_login_fields($user->id);
+
}