Commit | Line | Data |
---|---|---|
6a488035 TO |
1 | <?php |
2 | /* | |
3 | +--------------------------------------------------------------------+ | |
fee14197 | 4 | | CiviCRM version 5 | |
6a488035 | 5 | +--------------------------------------------------------------------+ |
6b83d5bd | 6 | | Copyright CiviCRM LLC (c) 2004-2019 | |
6a488035 TO |
7 | +--------------------------------------------------------------------+ |
8 | | This file is a part of CiviCRM. | | |
9 | | | | |
10 | | CiviCRM is free software; you can copy, modify, and distribute it | | |
11 | | under the terms of the GNU Affero General Public License | | |
12 | | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. | | |
13 | | | | |
14 | | CiviCRM is distributed in the hope that it will be useful, but | | |
15 | | WITHOUT ANY WARRANTY; without even the implied warranty of | | |
16 | | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | | |
17 | | See the GNU Affero General Public License for more details. | | |
18 | | | | |
19 | | You should have received a copy of the GNU Affero General Public | | |
20 | | License and the CiviCRM Licensing Exception along | | |
21 | | with this program; if not, contact CiviCRM LLC | | |
22 | | at info[AT]civicrm[DOT]org. If you have questions about the | | |
23 | | GNU Affero General Public License or the licensing of CiviCRM, | | |
24 | | see the CiviCRM license FAQ at http://civicrm.org/licensing | | |
25 | +--------------------------------------------------------------------+ | |
26 | */ | |
27 | ||
28 | /** | |
29 | * This class handles all REST client requests. | |
30 | * | |
31 | * @package CRM | |
6b83d5bd | 32 | * @copyright CiviCRM LLC (c) 2004-2019 |
6a488035 TO |
33 | */ |
34 | class CRM_Utils_REST { | |
35 | ||
36 | /** | |
37 | * Number of seconds we should let a REST process idle | |
6714d8d2 | 38 | * @var int |
6a488035 | 39 | */ |
6714d8d2 | 40 | public static $rest_timeout = 0; |
6a488035 TO |
41 | |
42 | /** | |
43 | * Cache the actual UF Class | |
6714d8d2 | 44 | * @var string |
6a488035 TO |
45 | */ |
46 | public $ufClass; | |
47 | ||
48 | /** | |
49 | * Class constructor. This caches the real user framework class locally, | |
50 | * so we can use it for authentication and validation. | |
51 | * | |
f4aaa82a | 52 | * @internal param string $uf The userframework class |
6a488035 TO |
53 | */ |
54 | public function __construct() { | |
55 | // any external program which call Rest Server is responsible for | |
56 | // creating and attaching the session | |
57 | $args = func_get_args(); | |
58 | $this->ufClass = array_shift($args); | |
59 | } | |
60 | ||
61 | /** | |
62 | * Simple ping function to test for liveness. | |
63 | * | |
77855840 TO |
64 | * @param string $var |
65 | * The string to be echoed. | |
6a488035 | 66 | * |
a6c01b45 | 67 | * @return string |
6a488035 | 68 | */ |
7f2d6a61 | 69 | public static function ping($var = NULL) { |
6a488035 TO |
70 | $session = CRM_Core_Session::singleton(); |
71 | $key = $session->get('key'); | |
50bfb460 | 72 | // $session->set( 'key', $var ); |
b3325339 | 73 | return self::simple(['message' => "PONG: $key"]); |
6a488035 TO |
74 | } |
75 | ||
5bc392e6 | 76 | /** |
fe482240 | 77 | * Generates values needed for error messages. |
5bc392e6 EM |
78 | * @param string $message |
79 | * | |
80 | * @return array | |
81 | */ | |
00be9182 | 82 | public static function error($message = 'Unknown Error') { |
b3325339 | 83 | $values = [ |
6a488035 TO |
84 | 'error_message' => $message, |
85 | 'is_error' => 1, | |
b3325339 | 86 | ]; |
6a488035 TO |
87 | return $values; |
88 | } | |
89 | ||
5bc392e6 | 90 | /** |
4f1f1f2a | 91 | * Generates values needed for non-error responses. |
c490a46a | 92 | * @param array $params |
5bc392e6 EM |
93 | * |
94 | * @return array | |
95 | */ | |
00be9182 | 96 | public static function simple($params) { |
b3325339 | 97 | $values = ['is_error' => 0]; |
6a488035 TO |
98 | $values += $params; |
99 | return $values; | |
100 | } | |
101 | ||
5bc392e6 EM |
102 | /** |
103 | * @return string | |
104 | */ | |
00be9182 | 105 | public function run() { |
6a488035 TO |
106 | $result = self::handle(); |
107 | return self::output($result); | |
108 | } | |
109 | ||
5bc392e6 EM |
110 | /** |
111 | * @return string | |
112 | */ | |
00be9182 | 113 | public function bootAndRun() { |
7f2d6a61 TO |
114 | $response = $this->loadCMSBootstrap(); |
115 | if (is_array($response)) { | |
116 | return self::output($response); | |
117 | } | |
118 | return $this->run(); | |
119 | } | |
120 | ||
5bc392e6 EM |
121 | /** |
122 | * @param $result | |
123 | * | |
124 | * @return string | |
125 | */ | |
00be9182 | 126 | public static function output(&$result) { |
ba56a28f TO |
127 | $requestParams = CRM_Utils_Request::exportValues(); |
128 | ||
6a488035 TO |
129 | $hier = FALSE; |
130 | if (is_scalar($result)) { | |
131 | if (!$result) { | |
132 | $result = 0; | |
133 | } | |
b3325339 | 134 | $result = self::simple(['result' => $result]); |
6a488035 TO |
135 | } |
136 | elseif (is_array($result)) { | |
137 | if (CRM_Utils_Array::isHierarchical($result)) { | |
138 | $hier = TRUE; | |
139 | } | |
140 | elseif (!array_key_exists('is_error', $result)) { | |
141 | $result['is_error'] = 0; | |
142 | } | |
143 | } | |
144 | else { | |
145 | $result = self::error('Could not interpret return values from function.'); | |
146 | } | |
147 | ||
3eec106c | 148 | if (!empty($requestParams['json'])) { |
3eec106c | 149 | if (!empty($requestParams['prettyprint'])) { |
b308e50d | 150 | // Don't set content-type header for api explorer output |
2d4a140a | 151 | return json_encode(array_merge($result), JSON_PRETTY_PRINT + JSON_UNESCAPED_SLASHES + JSON_UNESCAPED_UNICODE); |
108bcf37 | 152 | return self::jsonFormated(array_merge($result)); |
6a488035 | 153 | } |
b308e50d | 154 | CRM_Utils_System::setHttpHeader('Content-Type', 'application/json'); |
108bcf37 | 155 | return json_encode(array_merge($result)); |
6a488035 TO |
156 | } |
157 | ||
6a488035 | 158 | if (isset($result['count'])) { |
6a488035 | 159 | $count = ' count="' . $result['count'] . '" '; |
6a488035 | 160 | } |
a3e55d9c TO |
161 | else { |
162 | $count = ""; | |
e7292422 | 163 | } |
6a488035 TO |
164 | $xml = "<?xml version=\"1.0\"?> |
165 | <ResultSet xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" $count> | |
166 | "; | |
167 | // check if this is a single element result (contact_get etc) | |
168 | // or multi element | |
169 | if ($hier) { | |
59a4addf AN |
170 | foreach ($result['values'] as $k => $v) { |
171 | if (is_array($v)) { | |
172 | $xml .= "<Result>\n" . CRM_Utils_Array::xml($v) . "</Result>\n"; | |
173 | } | |
174 | elseif (!is_object($v)) { | |
175 | $xml .= "<Result>\n<id>{$k}</id><value>{$v}</value></Result>\n"; | |
176 | } | |
6a488035 TO |
177 | } |
178 | } | |
179 | else { | |
180 | $xml .= "<Result>\n" . CRM_Utils_Array::xml($result) . "</Result>\n"; | |
181 | } | |
182 | ||
183 | $xml .= "</ResultSet>\n"; | |
184 | return $xml; | |
185 | } | |
186 | ||
5bc392e6 EM |
187 | /** |
188 | * @return array|int | |
189 | */ | |
00be9182 | 190 | public static function handle() { |
ba56a28f TO |
191 | $requestParams = CRM_Utils_Request::exportValues(); |
192 | ||
6a488035 | 193 | // Get the function name being called from the q parameter in the query string |
35522279 | 194 | $q = CRM_Utils_Array::value('q', $requestParams); |
6a488035 | 195 | // or for the rest interface, from fnName |
35522279 | 196 | $r = CRM_Utils_Array::value('fnName', $requestParams); |
6a488035 TO |
197 | if (!empty($r)) { |
198 | $q = $r; | |
199 | } | |
35522279 | 200 | $entity = CRM_Utils_Array::value('entity', $requestParams); |
481a74f4 | 201 | if (empty($entity) && !empty($q)) { |
6a488035 TO |
202 | $args = explode('/', $q); |
203 | // If the function isn't in the civicrm namespace, reject the request. | |
204 | if ($args[0] != 'civicrm') { | |
205 | return self::error('Unknown function invocation.'); | |
206 | } | |
207 | ||
208 | // If the query string is malformed, reject the request. | |
7f2d6a61 TO |
209 | // Does this mean it will reject it |
210 | if ((count($args) != 3) && ($args[1] != 'ping')) { | |
6a488035 TO |
211 | return self::error('Unknown function invocation.'); |
212 | } | |
213 | $store = NULL; | |
f813f78e | 214 | |
7f2d6a61 | 215 | if ($args[1] == 'ping') { |
6a488035 TO |
216 | return self::ping(); |
217 | } | |
0db6c3e1 TO |
218 | } |
219 | else { | |
650ff635 | 220 | // or the api format (entity+action) |
b3325339 | 221 | $args = []; |
7f2d6a61 | 222 | $args[0] = 'civicrm'; |
35522279 J |
223 | $args[1] = CRM_Utils_Array::value('entity', $requestParams); |
224 | $args[2] = CRM_Utils_Array::value('action', $requestParams); | |
6a488035 | 225 | } |
f813f78e | 226 | |
6a488035 | 227 | // Everyone should be required to provide the server key, so the whole |
50bfb460 | 228 | // interface can be disabled in more change to the configuration file. |
6a488035 TO |
229 | // first check for civicrm site key |
230 | if (!CRM_Utils_System::authenticateKey(FALSE)) { | |
231 | $docLink = CRM_Utils_System::docURL2("Managing Scheduled Jobs", TRUE, NULL, NULL, NULL, "wiki"); | |
35522279 | 232 | $key = CRM_Utils_Array::value('key', $requestParams); |
6a488035 TO |
233 | if (empty($key)) { |
234 | return self::error("FATAL: mandatory param 'key' missing. More info at: " . $docLink); | |
235 | } | |
236 | return self::error("FATAL: 'key' is incorrect. More info at: " . $docLink); | |
237 | } | |
238 | ||
7f2d6a61 | 239 | // At this point we know we are not calling ping which does not require authentication. |
50bfb460 | 240 | // Therefore we now need a valid server key and API key. |
7f2d6a61 TO |
241 | // Check and see if a valid secret API key is provided. |
242 | $api_key = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST'); | |
243 | if (!$api_key || strtolower($api_key) == 'null') { | |
244 | return self::error("FATAL: mandatory param 'api_key' (user key) missing"); | |
6a488035 | 245 | } |
7f2d6a61 | 246 | $valid_user = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key'); |
6a488035 | 247 | |
7f2d6a61 | 248 | // If we didn't find a valid user, die |
6a488035 | 249 | if (empty($valid_user)) { |
7f2d6a61 | 250 | return self::error("User API key invalid"); |
6a488035 TO |
251 | } |
252 | ||
a323a20f | 253 | return self::process($args, self::buildParamList()); |
6a488035 TO |
254 | } |
255 | ||
5bc392e6 EM |
256 | /** |
257 | * @param $args | |
c490a46a | 258 | * @param array $params |
5bc392e6 EM |
259 | * |
260 | * @return array|int | |
261 | */ | |
00be9182 | 262 | public static function process(&$args, $params) { |
6a488035 TO |
263 | $params['check_permissions'] = TRUE; |
264 | $fnName = $apiFile = NULL; | |
265 | // clean up all function / class names. they should be alphanumeric and _ only | |
266 | for ($i = 1; $i <= 3; $i++) { | |
267 | if (!empty($args[$i])) { | |
268 | $args[$i] = CRM_Utils_String::munge($args[$i]); | |
269 | } | |
270 | } | |
271 | ||
272 | // incase of ajax functions className is passed in url | |
273 | if (isset($params['className'])) { | |
274 | $params['className'] = CRM_Utils_String::munge($params['className']); | |
275 | ||
276 | // functions that are defined only in AJAX.php can be called via | |
277 | // rest interface | |
278 | if (!CRM_Core_Page_AJAX::checkAuthz('method', $params['className'], $params['fnName'])) { | |
279 | return self::error('Unknown function invocation.'); | |
280 | } | |
281 | ||
b3325339 | 282 | return call_user_func([$params['className'], $params['fnName']], $params); |
6a488035 TO |
283 | } |
284 | ||
285 | if (!array_key_exists('version', $params)) { | |
286 | $params['version'] = 3; | |
287 | } | |
288 | ||
289 | if ($params['version'] == 2) { | |
290 | $result['is_error'] = 1; | |
291 | $result['error_message'] = "FATAL: API v2 not accessible from ajax/REST"; | |
292 | $result['deprecated'] = "Please upgrade to API v3"; | |
293 | return $result; | |
294 | } | |
295 | ||
92c11e8c | 296 | if ($_SERVER['REQUEST_METHOD'] == 'GET' && |
b3325339 | 297 | strtolower(substr($args[2], 0, 3)) != 'get' && |
298 | strtolower($args[2] != 'check')) { | |
f9e16e9a | 299 | // get only valid for non destructive methods |
6a488035 TO |
300 | require_once 'api/v3/utils.php'; |
301 | return civicrm_api3_create_error("SECURITY: All requests that modify the database must be http POST, not GET.", | |
b3325339 | 302 | [ |
6a488035 TO |
303 | 'IP' => $_SERVER['REMOTE_ADDR'], |
304 | 'level' => 'security', | |
305 | 'referer' => $_SERVER['HTTP_REFERER'], | |
306 | 'reason' => 'Destructive HTTP GET', | |
b3325339 | 307 | ] |
6a488035 TO |
308 | ); |
309 | } | |
310 | ||
311 | // trap all fatal errors | |
b3325339 | 312 | $errorScope = CRM_Core_TemporaryErrorScope::create([ |
313 | 'CRM_Utils_REST', | |
314 | 'fatal', | |
315 | ]); | |
6a488035 | 316 | $result = civicrm_api($args[1], $args[2], $params); |
ca32aecc | 317 | unset($errorScope); |
6a488035 TO |
318 | |
319 | if ($result === FALSE) { | |
320 | return self::error('Unknown error.'); | |
321 | } | |
322 | return $result; | |
323 | } | |
324 | ||
5bc392e6 EM |
325 | /** |
326 | * @return array|mixed|null | |
327 | */ | |
00be9182 | 328 | public static function &buildParamList() { |
ba56a28f | 329 | $requestParams = CRM_Utils_Request::exportValues(); |
b3325339 | 330 | $params = []; |
6a488035 | 331 | |
b3325339 | 332 | $skipVars = [ |
6a488035 TO |
333 | 'q' => 1, |
334 | 'json' => 1, | |
335 | 'key' => 1, | |
336 | 'api_key' => 1, | |
337 | 'entity' => 1, | |
338 | 'action' => 1, | |
b3325339 | 339 | ]; |
6a488035 | 340 | |
353ffa53 | 341 | if (array_key_exists('json', $requestParams) && $requestParams['json'][0] == "{") { |
ba56a28f | 342 | $params = json_decode($requestParams['json'], TRUE); |
22e263ad | 343 | if ($params === NULL) { |
b3325339 | 344 | CRM_Utils_JSON::output([ |
345 | 'is_error' => 1, | |
346 | 0 => 'error_message', | |
347 | 1 => 'Unable to decode supplied JSON.', | |
348 | ]); | |
6a488035 TO |
349 | } |
350 | } | |
ba56a28f | 351 | foreach ($requestParams as $n => $v) { |
6a488035 TO |
352 | if (!array_key_exists($n, $skipVars)) { |
353 | $params[$n] = $v; | |
354 | } | |
355 | } | |
ba56a28f | 356 | if (array_key_exists('return', $requestParams) && is_array($requestParams['return'])) { |
a3e55d9c TO |
357 | foreach ($requestParams['return'] as $key => $v) { |
358 | $params['return.' . $key] = 1; | |
e7292422 | 359 | } |
6a488035 TO |
360 | } |
361 | return $params; | |
362 | } | |
363 | ||
5bc392e6 EM |
364 | /** |
365 | * @param $pearError | |
366 | */ | |
00be9182 | 367 | public static function fatal($pearError) { |
d42a224c | 368 | CRM_Utils_System::setHttpHeader('Content-Type', 'text/xml'); |
b3325339 | 369 | $error = []; |
6a488035 TO |
370 | $error['code'] = $pearError->getCode(); |
371 | $error['error_message'] = $pearError->getMessage(); | |
372 | $error['mode'] = $pearError->getMode(); | |
373 | $error['debug_info'] = $pearError->getDebugInfo(); | |
374 | $error['type'] = $pearError->getType(); | |
375 | $error['user_info'] = $pearError->getUserInfo(); | |
376 | $error['to_string'] = $pearError->toString(); | |
377 | $error['is_error'] = 1; | |
378 | ||
379 | echo self::output($error); | |
380 | ||
381 | CRM_Utils_System::civiExit(); | |
382 | } | |
383 | ||
d5cc0fc2 | 384 | /** |
385 | * used to load a template "inline", eg. for ajax, without having to build a menu for each template | |
386 | */ | |
387 | public static function loadTemplate() { | |
481a74f4 | 388 | $request = CRM_Utils_Request::retrieve('q', 'String'); |
e7292422 | 389 | if (FALSE !== strpos($request, '..')) { |
b3325339 | 390 | die("SECURITY FATAL: the url can't contain '..'. Please report the issue on the forum at civicrm.org"); |
6a488035 TO |
391 | } |
392 | ||
d3e86119 | 393 | $request = explode('/', $request); |
6a488035 | 394 | $entity = _civicrm_api_get_camel_name($request[2]); |
e7292422 | 395 | $tplfile = _civicrm_api_get_camel_name($request[3]); |
6a488035 | 396 | |
92fcb95f | 397 | $tpl = 'CRM/' . $entity . '/Page/Inline/' . $tplfile . '.tpl'; |
481a74f4 TO |
398 | $smarty = CRM_Core_Smarty::singleton(); |
399 | CRM_Utils_System::setTitle("$entity::$tplfile inline $tpl"); | |
400 | if (!$smarty->template_exists($tpl)) { | |
d42a224c | 401 | CRM_Utils_System::setHttpHeader("Status", "404 Not Found"); |
b3325339 | 402 | die("Can't find the requested template file templates/$tpl"); |
6a488035 | 403 | } |
6714d8d2 SL |
404 | // special treatmenent, because it's often used |
405 | if (array_key_exists('id', $_GET)) { | |
406 | // an id is always positive | |
407 | $smarty->assign('id', (int) $_GET['id']); | |
6a488035 | 408 | } |
e7292422 | 409 | $pos = strpos(implode(array_keys($_GET)), '<'); |
6a488035 | 410 | |
e7292422 | 411 | if ($pos !== FALSE) { |
b3325339 | 412 | die("SECURITY FATAL: one of the param names contains <"); |
6a488035 | 413 | } |
481a74f4 | 414 | $param = array_map('htmlentities', $_GET); |
6a488035 TO |
415 | unset($param['q']); |
416 | $smarty->assign_by_ref("request", $param); | |
417 | ||
353ffa53 TO |
418 | if (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) || |
419 | $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest" | |
420 | ) { | |
6a488035 | 421 | |
481a74f4 | 422 | $smarty->assign('tplFile', $tpl); |
e7292422 | 423 | $config = CRM_Core_Config::singleton(); |
353ffa53 | 424 | $content = $smarty->fetch('CRM/common/' . strtolower($config->userFramework) . '.tpl'); |
6a488035 | 425 | |
e7292422 TO |
426 | if (!defined('CIVICRM_UF_HEAD') && $region = CRM_Core_Region::instance('html-header', FALSE)) { |
427 | CRM_Utils_System::addHTMLHead($region->render('')); | |
428 | } | |
481a74f4 | 429 | CRM_Utils_System::appendTPLFile($tpl, $content); |
6a488035 | 430 | |
e7292422 | 431 | return CRM_Utils_System::theme($content); |
6a488035 | 432 | |
0db6c3e1 TO |
433 | } |
434 | else { | |
b44e3f84 | 435 | $content = "<!-- .tpl file embedded: $tpl -->\n"; |
481a74f4 | 436 | CRM_Utils_System::appendTPLFile($tpl, $content); |
e7292422 | 437 | echo $content . $smarty->fetch($tpl); |
481a74f4 | 438 | CRM_Utils_System::civiExit(); |
6a488035 TO |
439 | } |
440 | } | |
441 | ||
d5cc0fc2 | 442 | /** |
443 | * This is a wrapper so you can call an api via json (it returns json too) | |
50bfb460 SB |
444 | * http://example.org/civicrm/api/json?entity=Contact&action=Get"&json={"contact_type":"Individual","email.get.email":{}} |
445 | * to take all the emails from individuals. | |
446 | * Works for POST & GET (POST recommended). | |
d5cc0fc2 | 447 | */ |
00be9182 | 448 | public static function ajaxJson() { |
ba56a28f TO |
449 | $requestParams = CRM_Utils_Request::exportValues(); |
450 | ||
6a488035 | 451 | require_once 'api/v3/utils.php'; |
650ff635 | 452 | $config = CRM_Core_Config::singleton(); |
7f2d6a61 | 453 | if (!$config->debug && (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) || |
6a488035 | 454 | $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest" |
353ffa53 TO |
455 | ) |
456 | ) { | |
e4176358 | 457 | $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().", |
b3325339 | 458 | [ |
6a488035 TO |
459 | 'IP' => $_SERVER['REMOTE_ADDR'], |
460 | 'level' => 'security', | |
461 | 'referer' => $_SERVER['HTTP_REFERER'], | |
462 | 'reason' => 'CSRF suspected', | |
b3325339 | 463 | ] |
6a488035 | 464 | ); |
ecdef330 | 465 | CRM_Utils_JSON::output($error); |
6a488035 | 466 | } |
ba56a28f | 467 | if (empty($requestParams['entity'])) { |
ecdef330 | 468 | CRM_Utils_JSON::output(civicrm_api3_create_error('missing entity param')); |
6a488035 | 469 | } |
ba56a28f | 470 | if (empty($requestParams['entity'])) { |
ecdef330 | 471 | CRM_Utils_JSON::output(civicrm_api3_create_error('missing entity entity')); |
6a488035 | 472 | } |
ba56a28f TO |
473 | if (!empty($requestParams['json'])) { |
474 | $params = json_decode($requestParams['json'], TRUE); | |
6a488035 | 475 | } |
ba56a28f TO |
476 | $entity = CRM_Utils_String::munge(CRM_Utils_Array::value('entity', $requestParams)); |
477 | $action = CRM_Utils_String::munge(CRM_Utils_Array::value('action', $requestParams)); | |
6a488035 | 478 | if (!is_array($params)) { |
b3325339 | 479 | CRM_Utils_JSON::output([ |
480 | 'is_error' => 1, | |
481 | 'error_message' => 'invalid json format: ?{"param_with_double_quote":"value"}', | |
482 | ]); | |
6a488035 TO |
483 | } |
484 | ||
485 | $params['check_permissions'] = TRUE; | |
486 | $params['version'] = 3; | |
6714d8d2 SL |
487 | // $requestParams is local-only; this line seems pointless unless there's a side-effect influencing other functions |
488 | $_GET['json'] = $requestParams['json'] = 1; | |
6a488035 TO |
489 | if (!$params['sequential']) { |
490 | $params['sequential'] = 1; | |
491 | } | |
ca32aecc | 492 | |
6a488035 | 493 | // trap all fatal errors |
b3325339 | 494 | $errorScope = CRM_Core_TemporaryErrorScope::create([ |
495 | 'CRM_Utils_REST', | |
496 | 'fatal', | |
497 | ]); | |
6a488035 | 498 | $result = civicrm_api($entity, $action, $params); |
ca32aecc | 499 | unset($errorScope); |
6a488035 TO |
500 | |
501 | echo self::output($result); | |
502 | ||
503 | CRM_Utils_System::civiExit(); | |
504 | } | |
505 | ||
b896fa44 EM |
506 | /** |
507 | * Run ajax request. | |
508 | * | |
509 | * @return array | |
510 | */ | |
00be9182 | 511 | public static function ajax() { |
ba56a28f TO |
512 | $requestParams = CRM_Utils_Request::exportValues(); |
513 | ||
6a488035 TO |
514 | // this is driven by the menu system, so we can use permissioning to |
515 | // restrict calls to this etc | |
516 | // the request has to be sent by an ajax call. First line of protection against csrf | |
517 | $config = CRM_Core_Config::singleton(); | |
7f2d6a61 | 518 | if (!$config->debug && |
6a488035 TO |
519 | (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) || |
520 | $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest" | |
521 | ) | |
522 | ) { | |
523 | require_once 'api/v3/utils.php'; | |
a323a20f | 524 | $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().", |
b3325339 | 525 | [ |
6a488035 TO |
526 | 'IP' => $_SERVER['REMOTE_ADDR'], |
527 | 'level' => 'security', | |
528 | 'referer' => $_SERVER['HTTP_REFERER'], | |
529 | 'reason' => 'CSRF suspected', | |
b3325339 | 530 | ] |
6a488035 | 531 | ); |
ecdef330 | 532 | CRM_Utils_JSON::output($error); |
6a488035 TO |
533 | } |
534 | ||
ba56a28f | 535 | $q = CRM_Utils_Array::value('fnName', $requestParams); |
6a488035 | 536 | if (!$q) { |
ba56a28f TO |
537 | $entity = CRM_Utils_Array::value('entity', $requestParams); |
538 | $action = CRM_Utils_Array::value('action', $requestParams); | |
6a488035 | 539 | if (!$entity || !$action) { |
b3325339 | 540 | $err = [ |
541 | 'error_message' => 'missing mandatory params "entity=" or "action="', | |
542 | 'is_error' => 1, | |
543 | ]; | |
6a488035 TO |
544 | echo self::output($err); |
545 | CRM_Utils_System::civiExit(); | |
546 | } | |
b3325339 | 547 | $args = ['civicrm', $entity, $action]; |
6a488035 TO |
548 | } |
549 | else { | |
550 | $args = explode('/', $q); | |
551 | } | |
552 | ||
553 | // get the class name, since all ajax functions pass className | |
ba56a28f | 554 | $className = CRM_Utils_Array::value('className', $requestParams); |
6a488035 TO |
555 | |
556 | // If the function isn't in the civicrm namespace, reject the request. | |
557 | if (($args[0] != 'civicrm' && count($args) != 3) && !$className) { | |
558 | return self::error('Unknown function invocation.'); | |
559 | } | |
560 | ||
a323a20f CW |
561 | // Support for multiple api calls |
562 | if (isset($entity) && $entity === 'api3') { | |
563 | $result = self::processMultiple(); | |
564 | } | |
565 | else { | |
566 | $result = self::process($args, self::buildParamList()); | |
567 | } | |
6a488035 TO |
568 | |
569 | echo self::output($result); | |
570 | ||
571 | CRM_Utils_System::civiExit(); | |
572 | } | |
573 | ||
a323a20f CW |
574 | /** |
575 | * Callback for multiple ajax api calls from CRM.api3() | |
576 | * @return array | |
577 | */ | |
00be9182 | 578 | public static function processMultiple() { |
b3325339 | 579 | $output = []; |
a323a20f | 580 | foreach (json_decode($_REQUEST['json'], TRUE) as $key => $call) { |
b3325339 | 581 | $args = [ |
a323a20f CW |
582 | 'civicrm', |
583 | $call[0], | |
584 | $call[1], | |
b3325339 | 585 | ]; |
586 | $output[$key] = self::process($args, CRM_Utils_Array::value(2, $call, [])); | |
a323a20f CW |
587 | } |
588 | return $output; | |
589 | } | |
590 | ||
7f2d6a61 | 591 | /** |
72b3a70c CW |
592 | * @return array|NULL |
593 | * NULL if execution should proceed; array if the response is already known | |
7f2d6a61 | 594 | */ |
00be9182 | 595 | public function loadCMSBootstrap() { |
ba56a28f | 596 | $requestParams = CRM_Utils_Request::exportValues(); |
35522279 | 597 | $q = CRM_Utils_Array::value('q', $requestParams); |
6a488035 TO |
598 | $args = explode('/', $q); |
599 | ||
7f2d6a61 TO |
600 | // Proceed with bootstrap for "?entity=X&action=Y" |
601 | // Proceed with bootstrap for "?q=civicrm/X/Y" but not "?q=civicrm/ping" | |
602 | if (!empty($q)) { | |
603 | if (count($args) == 2 && $args[1] == 'ping') { | |
b3325339 | 604 | CRM_Utils_System::loadBootStrap([], FALSE, FALSE); |
6714d8d2 SL |
605 | // this is pretty wonky but maybe there's some reason I can't see |
606 | return NULL; | |
7f2d6a61 TO |
607 | } |
608 | if (count($args) != 3) { | |
609 | return self::error('ERROR: Malformed REST path'); | |
610 | } | |
611 | if ($args[0] != 'civicrm') { | |
612 | return self::error('ERROR: Malformed REST path'); | |
613 | } | |
614 | // Therefore we have reasonably well-formed "?q=civicrm/X/Y" | |
6a488035 TO |
615 | } |
616 | ||
617 | if (!CRM_Utils_System::authenticateKey(FALSE)) { | |
7f2d6a61 TO |
618 | // FIXME: At time of writing, this doesn't actually do anything because |
619 | // authenticateKey abends, but that's a bad behavior which sends a | |
620 | // malformed response. | |
b3325339 | 621 | CRM_Utils_System::loadBootStrap([], FALSE, FALSE); |
7f2d6a61 | 622 | return self::error('Failed to authenticate key'); |
6a488035 TO |
623 | } |
624 | ||
625 | $uid = NULL; | |
6a488035 | 626 | if (!$uid) { |
353ffa53 TO |
627 | $store = NULL; |
628 | $api_key = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST'); | |
7f2d6a61 | 629 | if (empty($api_key)) { |
b3325339 | 630 | CRM_Utils_System::loadBootStrap([], FALSE, FALSE); |
7f2d6a61 TO |
631 | return self::error("FATAL: mandatory param 'api_key' (user key) missing"); |
632 | } | |
6a488035 TO |
633 | $contact_id = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key'); |
634 | if ($contact_id) { | |
635 | $uid = CRM_Core_BAO_UFMatch::getUFId($contact_id); | |
636 | } | |
637 | } | |
638 | ||
f320e5cd | 639 | if ($uid && $contact_id) { |
b3325339 | 640 | CRM_Utils_System::loadBootStrap(['uid' => $uid], TRUE, FALSE); |
f320e5cd DK |
641 | $session = CRM_Core_Session::singleton(); |
642 | $session->set('ufID', $uid); | |
643 | $session->set('userID', $contact_id); | |
35f52ba9 | 644 | CRM_Core_DAO::executeQuery('SET @civicrm_user_id = %1', |
b3325339 | 645 | [1 => [$contact_id, 'Integer']] |
35f52ba9 | 646 | ); |
7f2d6a61 TO |
647 | return NULL; |
648 | } | |
649 | else { | |
b3325339 | 650 | CRM_Utils_System::loadBootStrap([], FALSE, FALSE); |
7f2d6a61 | 651 | return self::error('ERROR: No CMS user associated with given api-key'); |
6a488035 TO |
652 | } |
653 | } | |
96025800 | 654 | |
6a488035 | 655 | } |