Commit | Line | Data |
---|---|---|
6a488035 TO |
1 | <?php |
2 | /* | |
3 | +--------------------------------------------------------------------+ | |
39de6fd5 | 4 | | CiviCRM version 4.6 | |
6a488035 | 5 | +--------------------------------------------------------------------+ |
e7112fa7 | 6 | | Copyright CiviCRM LLC (c) 2004-2015 | |
6a488035 TO |
7 | +--------------------------------------------------------------------+ |
8 | | This file is a part of CiviCRM. | | |
9 | | | | |
10 | | CiviCRM is free software; you can copy, modify, and distribute it | | |
11 | | under the terms of the GNU Affero General Public License | | |
12 | | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. | | |
13 | | | | |
14 | | CiviCRM is distributed in the hope that it will be useful, but | | |
15 | | WITHOUT ANY WARRANTY; without even the implied warranty of | | |
16 | | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | | |
17 | | See the GNU Affero General Public License for more details. | | |
18 | | | | |
19 | | You should have received a copy of the GNU Affero General Public | | |
20 | | License and the CiviCRM Licensing Exception along | | |
21 | | with this program; if not, contact CiviCRM LLC | | |
22 | | at info[AT]civicrm[DOT]org. If you have questions about the | | |
23 | | GNU Affero General Public License or the licensing of CiviCRM, | | |
24 | | see the CiviCRM license FAQ at http://civicrm.org/licensing | | |
25 | +--------------------------------------------------------------------+ | |
26 | */ | |
27 | ||
28 | /** | |
29 | * This class handles all REST client requests. | |
30 | * | |
31 | * @package CRM | |
e7112fa7 | 32 | * @copyright CiviCRM LLC (c) 2004-2015 |
6a488035 TO |
33 | * |
34 | */ | |
35 | class CRM_Utils_REST { | |
36 | ||
37 | /** | |
38 | * Number of seconds we should let a REST process idle | |
6a488035 TO |
39 | */ |
40 | static $rest_timeout = 0; | |
41 | ||
42 | /** | |
43 | * Cache the actual UF Class | |
44 | */ | |
45 | public $ufClass; | |
46 | ||
47 | /** | |
48 | * Class constructor. This caches the real user framework class locally, | |
49 | * so we can use it for authentication and validation. | |
50 | * | |
f4aaa82a | 51 | * @internal param string $uf The userframework class |
6a488035 TO |
52 | */ |
53 | public function __construct() { | |
54 | // any external program which call Rest Server is responsible for | |
55 | // creating and attaching the session | |
56 | $args = func_get_args(); | |
57 | $this->ufClass = array_shift($args); | |
58 | } | |
59 | ||
60 | /** | |
61 | * Simple ping function to test for liveness. | |
62 | * | |
77855840 TO |
63 | * @param string $var |
64 | * The string to be echoed. | |
6a488035 | 65 | * |
a6c01b45 | 66 | * @return string |
6a488035 | 67 | */ |
7f2d6a61 | 68 | public static function ping($var = NULL) { |
6a488035 TO |
69 | $session = CRM_Core_Session::singleton(); |
70 | $key = $session->get('key'); | |
71 | //$session->set( 'key', $var ); | |
72 | return self::simple(array('message' => "PONG: $key")); | |
73 | } | |
74 | ||
5bc392e6 | 75 | /** |
fe482240 | 76 | * Generates values needed for error messages. |
5bc392e6 EM |
77 | * @param string $message |
78 | * | |
79 | * @return array | |
80 | */ | |
00be9182 | 81 | public static function error($message = 'Unknown Error') { |
6a488035 TO |
82 | $values = array( |
83 | 'error_message' => $message, | |
84 | 'is_error' => 1, | |
85 | ); | |
86 | return $values; | |
87 | } | |
88 | ||
5bc392e6 | 89 | /** |
4f1f1f2a | 90 | * Generates values needed for non-error responses. |
c490a46a | 91 | * @param array $params |
5bc392e6 EM |
92 | * |
93 | * @return array | |
94 | */ | |
00be9182 | 95 | public static function simple($params) { |
6a488035 TO |
96 | $values = array('is_error' => 0); |
97 | $values += $params; | |
98 | return $values; | |
99 | } | |
100 | ||
5bc392e6 EM |
101 | /** |
102 | * @return string | |
103 | */ | |
00be9182 | 104 | public function run() { |
6a488035 TO |
105 | $result = self::handle(); |
106 | return self::output($result); | |
107 | } | |
108 | ||
5bc392e6 EM |
109 | /** |
110 | * @return string | |
111 | */ | |
00be9182 | 112 | public function bootAndRun() { |
7f2d6a61 TO |
113 | $response = $this->loadCMSBootstrap(); |
114 | if (is_array($response)) { | |
115 | return self::output($response); | |
116 | } | |
117 | return $this->run(); | |
118 | } | |
119 | ||
5bc392e6 EM |
120 | /** |
121 | * @param $result | |
122 | * | |
123 | * @return string | |
124 | */ | |
00be9182 | 125 | public static function output(&$result) { |
ba56a28f TO |
126 | $requestParams = CRM_Utils_Request::exportValues(); |
127 | ||
6a488035 TO |
128 | $hier = FALSE; |
129 | if (is_scalar($result)) { | |
130 | if (!$result) { | |
131 | $result = 0; | |
132 | } | |
133 | $result = self::simple(array('result' => $result)); | |
134 | } | |
135 | elseif (is_array($result)) { | |
136 | if (CRM_Utils_Array::isHierarchical($result)) { | |
137 | $hier = TRUE; | |
138 | } | |
139 | elseif (!array_key_exists('is_error', $result)) { | |
140 | $result['is_error'] = 0; | |
141 | } | |
142 | } | |
143 | else { | |
144 | $result = self::error('Could not interpret return values from function.'); | |
145 | } | |
146 | ||
3eec106c CW |
147 | if (!empty($requestParams['json'])) { |
148 | header('Content-Type: application/json'); | |
3eec106c CW |
149 | if (!empty($requestParams['prettyprint'])) { |
150 | // Used by the api explorer | |
108bcf37 | 151 | return self::jsonFormated(array_merge($result)); |
6a488035 | 152 | } |
108bcf37 | 153 | return json_encode(array_merge($result)); |
6a488035 TO |
154 | } |
155 | ||
6a488035 | 156 | if (isset($result['count'])) { |
6a488035 | 157 | $count = ' count="' . $result['count'] . '" '; |
6a488035 | 158 | } |
a3e55d9c TO |
159 | else { |
160 | $count = ""; | |
e7292422 | 161 | } |
6a488035 TO |
162 | $xml = "<?xml version=\"1.0\"?> |
163 | <ResultSet xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" $count> | |
164 | "; | |
165 | // check if this is a single element result (contact_get etc) | |
166 | // or multi element | |
167 | if ($hier) { | |
168 | foreach ($result['values'] as $n => $v) { | |
169 | $xml .= "<Result>\n" . CRM_Utils_Array::xml($v) . "</Result>\n"; | |
170 | } | |
171 | } | |
172 | else { | |
173 | $xml .= "<Result>\n" . CRM_Utils_Array::xml($result) . "</Result>\n"; | |
174 | } | |
175 | ||
176 | $xml .= "</ResultSet>\n"; | |
177 | return $xml; | |
178 | } | |
179 | ||
5bc392e6 | 180 | /** |
108bcf37 CW |
181 | * @param $data |
182 | * | |
183 | * @deprecated - switch to native JSON_PRETTY_PRINT when we drop support for php 5.3 | |
5bc392e6 EM |
184 | * |
185 | * @return string | |
186 | */ | |
108bcf37 CW |
187 | public static function jsonFormated($data) { |
188 | // If php is 5.4+ we can use the native method | |
189 | if (defined('JSON_PRETTY_PRINT')) { | |
695ad4c7 | 190 | return json_encode($data, JSON_PRETTY_PRINT + JSON_UNESCAPED_SLASHES + JSON_UNESCAPED_UNICODE); |
108bcf37 CW |
191 | } |
192 | ||
193 | // PHP 5.3 shim | |
194 | $json = str_replace('\/', '/', json_encode($data)); | |
353ffa53 TO |
195 | $tabcount = 0; |
196 | $result = ''; | |
197 | $inquote = FALSE; | |
198 | $inarray = FALSE; | |
6a488035 TO |
199 | $ignorenext = FALSE; |
200 | ||
201 | $tab = "\t"; | |
202 | $newline = "\n"; | |
203 | ||
204 | for ($i = 0; $i < strlen($json); $i++) { | |
205 | $char = $json[$i]; | |
206 | ||
207 | if ($ignorenext) { | |
208 | $result .= $char; | |
209 | $ignorenext = FALSE; | |
210 | } | |
211 | else { | |
212 | switch ($char) { | |
213 | case '{': | |
214 | if ($inquote) { | |
215 | $result .= $char; | |
216 | } | |
217 | else { | |
218 | $inarray = FALSE; | |
219 | $tabcount++; | |
220 | $result .= $char . $newline . str_repeat($tab, $tabcount); | |
221 | } | |
222 | break; | |
223 | ||
224 | case '}': | |
225 | if ($inquote) { | |
226 | $result .= $char; | |
227 | } | |
228 | else { | |
229 | $tabcount--; | |
230 | $result = trim($result) . $newline . str_repeat($tab, $tabcount) . $char; | |
231 | } | |
232 | break; | |
233 | ||
234 | case ',': | |
235 | if ($inquote || $inarray) { | |
236 | $result .= $char; | |
237 | } | |
a3e55d9c TO |
238 | else { |
239 | $result .= $char . $newline . str_repeat($tab, $tabcount); | |
e7292422 | 240 | } |
6a488035 TO |
241 | break; |
242 | ||
243 | case '"': | |
244 | $inquote = !$inquote; | |
245 | $result .= $char; | |
246 | break; | |
247 | ||
248 | case '\\': | |
249 | if ($inquote) { | |
250 | $ignorenext = TRUE; | |
251 | } | |
252 | $result .= $char; | |
253 | break; | |
254 | ||
255 | case '[': | |
256 | $inarray = TRUE; | |
257 | $result .= $char; | |
258 | break; | |
259 | ||
260 | case ']': | |
261 | $inarray = FALSE; | |
262 | $result .= $char; | |
263 | break; | |
264 | ||
265 | default: | |
266 | $result .= $char; | |
267 | } | |
268 | } | |
269 | } | |
270 | ||
271 | return $result; | |
272 | } | |
273 | ||
5bc392e6 EM |
274 | /** |
275 | * @return array|int | |
276 | */ | |
00be9182 | 277 | public static function handle() { |
ba56a28f TO |
278 | $requestParams = CRM_Utils_Request::exportValues(); |
279 | ||
6a488035 | 280 | // Get the function name being called from the q parameter in the query string |
ba56a28f | 281 | $q = CRM_Utils_array::value('q', $requestParams); |
6a488035 | 282 | // or for the rest interface, from fnName |
ba56a28f | 283 | $r = CRM_Utils_array::value('fnName', $requestParams); |
6a488035 TO |
284 | if (!empty($r)) { |
285 | $q = $r; | |
286 | } | |
775d38eb | 287 | $entity = CRM_Utils_array::value('entity', $requestParams); |
481a74f4 | 288 | if (empty($entity) && !empty($q)) { |
6a488035 TO |
289 | $args = explode('/', $q); |
290 | // If the function isn't in the civicrm namespace, reject the request. | |
291 | if ($args[0] != 'civicrm') { | |
292 | return self::error('Unknown function invocation.'); | |
293 | } | |
294 | ||
295 | // If the query string is malformed, reject the request. | |
7f2d6a61 TO |
296 | // Does this mean it will reject it |
297 | if ((count($args) != 3) && ($args[1] != 'ping')) { | |
6a488035 TO |
298 | return self::error('Unknown function invocation.'); |
299 | } | |
300 | $store = NULL; | |
f813f78e | 301 | |
7f2d6a61 | 302 | if ($args[1] == 'ping') { |
6a488035 TO |
303 | return self::ping(); |
304 | } | |
0db6c3e1 TO |
305 | } |
306 | else { | |
6a488035 | 307 | // or the new format (entity+action) |
7f2d6a61 TO |
308 | $args = array(); |
309 | $args[0] = 'civicrm'; | |
ba56a28f TO |
310 | $args[1] = CRM_Utils_array::value('entity', $requestParams); |
311 | $args[2] = CRM_Utils_array::value('action', $requestParams); | |
6a488035 | 312 | } |
f813f78e | 313 | |
6a488035 TO |
314 | // Everyone should be required to provide the server key, so the whole |
315 | // interface can be disabled in more change to the configuration file. | |
6a488035 TO |
316 | // first check for civicrm site key |
317 | if (!CRM_Utils_System::authenticateKey(FALSE)) { | |
318 | $docLink = CRM_Utils_System::docURL2("Managing Scheduled Jobs", TRUE, NULL, NULL, NULL, "wiki"); | |
ba56a28f | 319 | $key = CRM_Utils_array::value('key', $requestParams); |
6a488035 TO |
320 | if (empty($key)) { |
321 | return self::error("FATAL: mandatory param 'key' missing. More info at: " . $docLink); | |
322 | } | |
323 | return self::error("FATAL: 'key' is incorrect. More info at: " . $docLink); | |
324 | } | |
325 | ||
7f2d6a61 TO |
326 | // At this point we know we are not calling ping which does not require authentication. |
327 | // Therefore, at this point we need to make sure we're working with a trusted user. | |
328 | // Valid users are those who provide a valid server key and API key | |
6a488035 TO |
329 | |
330 | $valid_user = FALSE; | |
331 | ||
7f2d6a61 TO |
332 | // Check and see if a valid secret API key is provided. |
333 | $api_key = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST'); | |
334 | if (!$api_key || strtolower($api_key) == 'null') { | |
335 | return self::error("FATAL: mandatory param 'api_key' (user key) missing"); | |
6a488035 | 336 | } |
7f2d6a61 | 337 | $valid_user = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key'); |
6a488035 | 338 | |
7f2d6a61 | 339 | // If we didn't find a valid user, die |
6a488035 | 340 | if (empty($valid_user)) { |
7f2d6a61 | 341 | return self::error("User API key invalid"); |
6a488035 TO |
342 | } |
343 | ||
a323a20f | 344 | return self::process($args, self::buildParamList()); |
6a488035 TO |
345 | } |
346 | ||
5bc392e6 EM |
347 | /** |
348 | * @param $args | |
c490a46a | 349 | * @param array $params |
5bc392e6 EM |
350 | * |
351 | * @return array|int | |
352 | */ | |
00be9182 | 353 | public static function process(&$args, $params) { |
6a488035 TO |
354 | $params['check_permissions'] = TRUE; |
355 | $fnName = $apiFile = NULL; | |
356 | // clean up all function / class names. they should be alphanumeric and _ only | |
357 | for ($i = 1; $i <= 3; $i++) { | |
358 | if (!empty($args[$i])) { | |
359 | $args[$i] = CRM_Utils_String::munge($args[$i]); | |
360 | } | |
361 | } | |
362 | ||
363 | // incase of ajax functions className is passed in url | |
364 | if (isset($params['className'])) { | |
365 | $params['className'] = CRM_Utils_String::munge($params['className']); | |
366 | ||
367 | // functions that are defined only in AJAX.php can be called via | |
368 | // rest interface | |
369 | if (!CRM_Core_Page_AJAX::checkAuthz('method', $params['className'], $params['fnName'])) { | |
370 | return self::error('Unknown function invocation.'); | |
371 | } | |
372 | ||
373 | return call_user_func(array($params['className'], $params['fnName']), $params); | |
374 | } | |
375 | ||
376 | if (!array_key_exists('version', $params)) { | |
377 | $params['version'] = 3; | |
378 | } | |
379 | ||
380 | if ($params['version'] == 2) { | |
381 | $result['is_error'] = 1; | |
382 | $result['error_message'] = "FATAL: API v2 not accessible from ajax/REST"; | |
383 | $result['deprecated'] = "Please upgrade to API v3"; | |
384 | return $result; | |
385 | } | |
386 | ||
92c11e8c J |
387 | if ($_SERVER['REQUEST_METHOD'] == 'GET' && |
388 | strtolower(substr($args[2], 0, 3)) != 'get' && | |
389 | strtolower($args[2] != 'check')) { | |
f9e16e9a | 390 | // get only valid for non destructive methods |
6a488035 TO |
391 | require_once 'api/v3/utils.php'; |
392 | return civicrm_api3_create_error("SECURITY: All requests that modify the database must be http POST, not GET.", | |
393 | array( | |
394 | 'IP' => $_SERVER['REMOTE_ADDR'], | |
395 | 'level' => 'security', | |
396 | 'referer' => $_SERVER['HTTP_REFERER'], | |
397 | 'reason' => 'Destructive HTTP GET', | |
398 | ) | |
399 | ); | |
400 | } | |
401 | ||
402 | // trap all fatal errors | |
ca32aecc | 403 | $errorScope = CRM_Core_TemporaryErrorScope::create(array('CRM_Utils_REST', 'fatal')); |
6a488035 | 404 | $result = civicrm_api($args[1], $args[2], $params); |
ca32aecc | 405 | unset($errorScope); |
6a488035 TO |
406 | |
407 | if ($result === FALSE) { | |
408 | return self::error('Unknown error.'); | |
409 | } | |
410 | return $result; | |
411 | } | |
412 | ||
5bc392e6 EM |
413 | /** |
414 | * @return array|mixed|null | |
415 | */ | |
00be9182 | 416 | public static function &buildParamList() { |
ba56a28f | 417 | $requestParams = CRM_Utils_Request::exportValues(); |
6a488035 TO |
418 | $params = array(); |
419 | ||
420 | $skipVars = array( | |
421 | 'q' => 1, | |
422 | 'json' => 1, | |
423 | 'key' => 1, | |
424 | 'api_key' => 1, | |
425 | 'entity' => 1, | |
426 | 'action' => 1, | |
427 | ); | |
428 | ||
353ffa53 | 429 | if (array_key_exists('json', $requestParams) && $requestParams['json'][0] == "{") { |
ba56a28f | 430 | $params = json_decode($requestParams['json'], TRUE); |
22e263ad | 431 | if ($params === NULL) { |
ecdef330 | 432 | CRM_Utils_JSON::output(array('is_error' => 1, 'error_message', 'Unable to decode supplied JSON.')); |
6a488035 TO |
433 | } |
434 | } | |
ba56a28f | 435 | foreach ($requestParams as $n => $v) { |
6a488035 TO |
436 | if (!array_key_exists($n, $skipVars)) { |
437 | $params[$n] = $v; | |
438 | } | |
439 | } | |
ba56a28f | 440 | if (array_key_exists('return', $requestParams) && is_array($requestParams['return'])) { |
a3e55d9c TO |
441 | foreach ($requestParams['return'] as $key => $v) { |
442 | $params['return.' . $key] = 1; | |
e7292422 | 443 | } |
6a488035 TO |
444 | } |
445 | return $params; | |
446 | } | |
447 | ||
5bc392e6 EM |
448 | /** |
449 | * @param $pearError | |
450 | */ | |
00be9182 | 451 | public static function fatal($pearError) { |
6a488035 TO |
452 | header('Content-Type: text/xml'); |
453 | $error = array(); | |
454 | $error['code'] = $pearError->getCode(); | |
455 | $error['error_message'] = $pearError->getMessage(); | |
456 | $error['mode'] = $pearError->getMode(); | |
457 | $error['debug_info'] = $pearError->getDebugInfo(); | |
458 | $error['type'] = $pearError->getType(); | |
459 | $error['user_info'] = $pearError->getUserInfo(); | |
460 | $error['to_string'] = $pearError->toString(); | |
461 | $error['is_error'] = 1; | |
462 | ||
463 | echo self::output($error); | |
464 | ||
465 | CRM_Utils_System::civiExit(); | |
466 | } | |
467 | ||
d5cc0fc2 | 468 | /** |
469 | * used to load a template "inline", eg. for ajax, without having to build a menu for each template | |
470 | */ | |
471 | public static function loadTemplate() { | |
481a74f4 | 472 | $request = CRM_Utils_Request::retrieve('q', 'String'); |
e7292422 | 473 | if (FALSE !== strpos($request, '..')) { |
6a488035 TO |
474 | die ("SECURITY FATAL: the url can't contain '..'. Please report the issue on the forum at civicrm.org"); |
475 | } | |
476 | ||
d3e86119 | 477 | $request = explode('/', $request); |
6a488035 | 478 | $entity = _civicrm_api_get_camel_name($request[2]); |
e7292422 | 479 | $tplfile = _civicrm_api_get_camel_name($request[3]); |
6a488035 | 480 | |
92fcb95f | 481 | $tpl = 'CRM/' . $entity . '/Page/Inline/' . $tplfile . '.tpl'; |
481a74f4 TO |
482 | $smarty = CRM_Core_Smarty::singleton(); |
483 | CRM_Utils_System::setTitle("$entity::$tplfile inline $tpl"); | |
484 | if (!$smarty->template_exists($tpl)) { | |
6a488035 TO |
485 | header("Status: 404 Not Found"); |
486 | die ("Can't find the requested template file templates/$tpl"); | |
487 | } | |
e7292422 TO |
488 | if (array_key_exists('id', $_GET)) {// special treatmenent, because it's often used |
489 | $smarty->assign('id', (int) $_GET['id']);// an id is always positive | |
6a488035 | 490 | } |
e7292422 | 491 | $pos = strpos(implode(array_keys($_GET)), '<'); |
6a488035 | 492 | |
e7292422 | 493 | if ($pos !== FALSE) { |
6a488035 TO |
494 | die ("SECURITY FATAL: one of the param names contains <"); |
495 | } | |
481a74f4 | 496 | $param = array_map('htmlentities', $_GET); |
6a488035 TO |
497 | unset($param['q']); |
498 | $smarty->assign_by_ref("request", $param); | |
499 | ||
353ffa53 TO |
500 | if (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) || |
501 | $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest" | |
502 | ) { | |
6a488035 | 503 | |
481a74f4 | 504 | $smarty->assign('tplFile', $tpl); |
e7292422 | 505 | $config = CRM_Core_Config::singleton(); |
353ffa53 | 506 | $content = $smarty->fetch('CRM/common/' . strtolower($config->userFramework) . '.tpl'); |
6a488035 | 507 | |
e7292422 TO |
508 | if (!defined('CIVICRM_UF_HEAD') && $region = CRM_Core_Region::instance('html-header', FALSE)) { |
509 | CRM_Utils_System::addHTMLHead($region->render('')); | |
510 | } | |
481a74f4 | 511 | CRM_Utils_System::appendTPLFile($tpl, $content); |
6a488035 | 512 | |
e7292422 | 513 | return CRM_Utils_System::theme($content); |
6a488035 | 514 | |
0db6c3e1 TO |
515 | } |
516 | else { | |
e7292422 | 517 | $content = "<!-- .tpl file embeded: $tpl -->\n"; |
481a74f4 | 518 | CRM_Utils_System::appendTPLFile($tpl, $content); |
e7292422 | 519 | echo $content . $smarty->fetch($tpl); |
481a74f4 | 520 | CRM_Utils_System::civiExit(); |
6a488035 TO |
521 | } |
522 | } | |
523 | ||
d5cc0fc2 | 524 | /** |
525 | * This is a wrapper so you can call an api via json (it returns json too) | |
6a488035 TO |
526 | * http://example.org/civicrm/api/json?entity=Contact&action=Get"&json={"contact_type":"Individual","email.get.email":{}} to take all the emails from individuals |
527 | * works for POST & GET (POST recommended) | |
d5cc0fc2 | 528 | */ |
00be9182 | 529 | public static function ajaxJson() { |
ba56a28f TO |
530 | $requestParams = CRM_Utils_Request::exportValues(); |
531 | ||
6a488035 | 532 | require_once 'api/v3/utils.php'; |
ba56a28f | 533 | // Why is $config undefined -- $config = CRM_Core_Config::singleton(); |
7f2d6a61 | 534 | if (!$config->debug && (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) || |
6a488035 | 535 | $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest" |
353ffa53 TO |
536 | ) |
537 | ) { | |
e4176358 | 538 | $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().", |
6a488035 TO |
539 | array( |
540 | 'IP' => $_SERVER['REMOTE_ADDR'], | |
541 | 'level' => 'security', | |
542 | 'referer' => $_SERVER['HTTP_REFERER'], | |
543 | 'reason' => 'CSRF suspected', | |
544 | ) | |
545 | ); | |
ecdef330 | 546 | CRM_Utils_JSON::output($error); |
6a488035 | 547 | } |
ba56a28f | 548 | if (empty($requestParams['entity'])) { |
ecdef330 | 549 | CRM_Utils_JSON::output(civicrm_api3_create_error('missing entity param')); |
6a488035 | 550 | } |
ba56a28f | 551 | if (empty($requestParams['entity'])) { |
ecdef330 | 552 | CRM_Utils_JSON::output(civicrm_api3_create_error('missing entity entity')); |
6a488035 | 553 | } |
ba56a28f TO |
554 | if (!empty($requestParams['json'])) { |
555 | $params = json_decode($requestParams['json'], TRUE); | |
6a488035 | 556 | } |
ba56a28f TO |
557 | $entity = CRM_Utils_String::munge(CRM_Utils_Array::value('entity', $requestParams)); |
558 | $action = CRM_Utils_String::munge(CRM_Utils_Array::value('action', $requestParams)); | |
6a488035 | 559 | if (!is_array($params)) { |
353ffa53 TO |
560 | CRM_Utils_JSON::output(array( |
561 | 'is_error' => 1, | |
d5cc0fc2 | 562 | 'error_message' => 'invalid json format: ?{"param_with_double_quote":"value"}', |
353ffa53 | 563 | )); |
6a488035 TO |
564 | } |
565 | ||
566 | $params['check_permissions'] = TRUE; | |
567 | $params['version'] = 3; | |
ba56a28f | 568 | $_GET['json'] = $requestParams['json'] = 1; // $requestParams is local-only; this line seems pointless unless there's a side-effect influencing other functions |
6a488035 TO |
569 | if (!$params['sequential']) { |
570 | $params['sequential'] = 1; | |
571 | } | |
ca32aecc | 572 | |
6a488035 | 573 | // trap all fatal errors |
ca32aecc | 574 | $errorScope = CRM_Core_TemporaryErrorScope::create(array('CRM_Utils_REST', 'fatal')); |
6a488035 | 575 | $result = civicrm_api($entity, $action, $params); |
ca32aecc | 576 | unset($errorScope); |
6a488035 TO |
577 | |
578 | echo self::output($result); | |
579 | ||
580 | CRM_Utils_System::civiExit(); | |
581 | } | |
582 | ||
b896fa44 EM |
583 | /** |
584 | * Run ajax request. | |
585 | * | |
586 | * @return array | |
587 | */ | |
00be9182 | 588 | public static function ajax() { |
ba56a28f TO |
589 | $requestParams = CRM_Utils_Request::exportValues(); |
590 | ||
6a488035 TO |
591 | // this is driven by the menu system, so we can use permissioning to |
592 | // restrict calls to this etc | |
593 | // the request has to be sent by an ajax call. First line of protection against csrf | |
594 | $config = CRM_Core_Config::singleton(); | |
7f2d6a61 | 595 | if (!$config->debug && |
6a488035 TO |
596 | (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) || |
597 | $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest" | |
598 | ) | |
599 | ) { | |
600 | require_once 'api/v3/utils.php'; | |
a323a20f | 601 | $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().", |
6a488035 TO |
602 | array( |
603 | 'IP' => $_SERVER['REMOTE_ADDR'], | |
604 | 'level' => 'security', | |
605 | 'referer' => $_SERVER['HTTP_REFERER'], | |
606 | 'reason' => 'CSRF suspected', | |
607 | ) | |
608 | ); | |
ecdef330 | 609 | CRM_Utils_JSON::output($error); |
6a488035 TO |
610 | } |
611 | ||
ba56a28f | 612 | $q = CRM_Utils_Array::value('fnName', $requestParams); |
6a488035 | 613 | if (!$q) { |
ba56a28f TO |
614 | $entity = CRM_Utils_Array::value('entity', $requestParams); |
615 | $action = CRM_Utils_Array::value('action', $requestParams); | |
6a488035 TO |
616 | if (!$entity || !$action) { |
617 | $err = array('error_message' => 'missing mandatory params "entity=" or "action="', 'is_error' => 1); | |
618 | echo self::output($err); | |
619 | CRM_Utils_System::civiExit(); | |
620 | } | |
621 | $args = array('civicrm', $entity, $action); | |
622 | } | |
623 | else { | |
624 | $args = explode('/', $q); | |
625 | } | |
626 | ||
627 | // get the class name, since all ajax functions pass className | |
ba56a28f | 628 | $className = CRM_Utils_Array::value('className', $requestParams); |
6a488035 TO |
629 | |
630 | // If the function isn't in the civicrm namespace, reject the request. | |
631 | if (($args[0] != 'civicrm' && count($args) != 3) && !$className) { | |
632 | return self::error('Unknown function invocation.'); | |
633 | } | |
634 | ||
a323a20f CW |
635 | // Support for multiple api calls |
636 | if (isset($entity) && $entity === 'api3') { | |
637 | $result = self::processMultiple(); | |
638 | } | |
639 | else { | |
640 | $result = self::process($args, self::buildParamList()); | |
641 | } | |
6a488035 TO |
642 | |
643 | echo self::output($result); | |
644 | ||
645 | CRM_Utils_System::civiExit(); | |
646 | } | |
647 | ||
a323a20f CW |
648 | /** |
649 | * Callback for multiple ajax api calls from CRM.api3() | |
650 | * @return array | |
651 | */ | |
00be9182 | 652 | public static function processMultiple() { |
a323a20f CW |
653 | $output = array(); |
654 | foreach (json_decode($_REQUEST['json'], TRUE) as $key => $call) { | |
655 | $args = array( | |
656 | 'civicrm', | |
657 | $call[0], | |
658 | $call[1], | |
659 | ); | |
660 | $output[$key] = self::process($args, CRM_Utils_Array::value(2, $call, array())); | |
661 | } | |
662 | return $output; | |
663 | } | |
664 | ||
7f2d6a61 | 665 | /** |
72b3a70c CW |
666 | * @return array|NULL |
667 | * NULL if execution should proceed; array if the response is already known | |
7f2d6a61 | 668 | */ |
00be9182 | 669 | public function loadCMSBootstrap() { |
ba56a28f TO |
670 | $requestParams = CRM_Utils_Request::exportValues(); |
671 | $q = CRM_Utils_array::value('q', $requestParams); | |
6a488035 TO |
672 | $args = explode('/', $q); |
673 | ||
7f2d6a61 TO |
674 | // Proceed with bootstrap for "?entity=X&action=Y" |
675 | // Proceed with bootstrap for "?q=civicrm/X/Y" but not "?q=civicrm/ping" | |
676 | if (!empty($q)) { | |
677 | if (count($args) == 2 && $args[1] == 'ping') { | |
678 | return NULL; // this is pretty wonky but maybe there's some reason I can't see | |
679 | } | |
680 | if (count($args) != 3) { | |
681 | return self::error('ERROR: Malformed REST path'); | |
682 | } | |
683 | if ($args[0] != 'civicrm') { | |
684 | return self::error('ERROR: Malformed REST path'); | |
685 | } | |
686 | // Therefore we have reasonably well-formed "?q=civicrm/X/Y" | |
6a488035 TO |
687 | } |
688 | ||
689 | if (!CRM_Utils_System::authenticateKey(FALSE)) { | |
7f2d6a61 TO |
690 | // FIXME: At time of writing, this doesn't actually do anything because |
691 | // authenticateKey abends, but that's a bad behavior which sends a | |
692 | // malformed response. | |
693 | return self::error('Failed to authenticate key'); | |
6a488035 TO |
694 | } |
695 | ||
696 | $uid = NULL; | |
6a488035 | 697 | if (!$uid) { |
353ffa53 TO |
698 | $store = NULL; |
699 | $api_key = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST'); | |
7f2d6a61 TO |
700 | if (empty($api_key)) { |
701 | return self::error("FATAL: mandatory param 'api_key' (user key) missing"); | |
702 | } | |
6a488035 TO |
703 | $contact_id = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key'); |
704 | if ($contact_id) { | |
705 | $uid = CRM_Core_BAO_UFMatch::getUFId($contact_id); | |
706 | } | |
707 | } | |
708 | ||
709 | if ($uid) { | |
710 | CRM_Utils_System::loadBootStrap(array('uid' => $uid), TRUE, FALSE); | |
7f2d6a61 TO |
711 | return NULL; |
712 | } | |
713 | else { | |
714 | return self::error('ERROR: No CMS user associated with given api-key'); | |
6a488035 TO |
715 | } |
716 | } | |
96025800 | 717 | |
6a488035 | 718 | } |