3 +--------------------------------------------------------------------+
4 | CiviCRM version 4.7 |
5 +--------------------------------------------------------------------+
6 | Copyright CiviCRM LLC (c) 2004-2015 |
7 +--------------------------------------------------------------------+
8 | This file is a part of CiviCRM. |
10 | CiviCRM is free software; you can copy, modify, and distribute it |
11 | under the terms of the GNU Affero General Public License |
12 | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. |
14 | CiviCRM is distributed in the hope that it will be useful, but |
15 | WITHOUT ANY WARRANTY; without even the implied warranty of |
16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
17 | See the GNU Affero General Public License for more details. |
19 | You should have received a copy of the GNU Affero General Public |
20 | License and the CiviCRM Licensing Exception along |
21 | with this program; if not, contact CiviCRM LLC |
22 | at info[AT]civicrm[DOT]org. If you have questions about the |
23 | GNU Affero General Public License or the licensing of CiviCRM, |
24 | see the CiviCRM license FAQ at http://civicrm.org/licensing |
25 +--------------------------------------------------------------------+
28 use Civi\Cxn\Rpc\Constants
;
29 use Civi\Cxn\Rpc\DefaultCertificateValidator
;
34 * @copyright CiviCRM LLC (c) 2004-2015
38 * This class helps to manage connections to third-party apps.
40 class CRM_Cxn_BAO_Cxn
extends CRM_Cxn_DAO_Cxn
{
43 * Determine the current site's callback URL.
47 public static function getSiteCallbackUrl() {
48 $config = CRM_Core_Config
::singleton();
50 if (preg_match('/^(http|https):/', $config->resourceBase
)) {
51 $civiUrl = $config->resourceBase
;
54 $civiUrl = rtrim(CRM_Utils_System
::baseURL(), '/') . '/' . ltrim($config->resourceBase
, '/');
57 // In practice, this may not be necessary, but we want to prevent
58 // edge-cases that downgrade security-level below system policy.
59 if (Civi
::settings()->get('enableSSL')) {
60 $civiUrl = preg_replace('/^http:/', 'https:', $civiUrl);
63 return rtrim($civiUrl, '/') . '/extern/cxn.php';
67 * Update the AppMeta for any existing connections.
69 * @param array $appMeta
70 * @throws \Civi\Cxn\Rpc\Exception\CxnException
72 public static function updateAppMeta($appMeta) {
73 \Civi\Cxn\Rpc\AppMeta
::validate($appMeta);
74 CRM_Core_DAO
::executeQuery('UPDATE civicrm_cxn SET app_meta = %1 WHERE app_guid = %2', array(
75 1 => array(json_encode($appMeta), 'String'),
76 2 => array($appMeta['appId'], 'String'),
81 * Get the AppMeta for an existing connection.
83 * @param string $cxnId
85 * @throws \Civi\Cxn\Rpc\Exception\CxnException
87 public static function getAppMeta($cxnId) {
88 $appMetaJson = CRM_Core_DAO
::getFieldValue('CRM_Cxn_DAO_Cxn', $cxnId, 'app_meta', 'cxn_guid', TRUE);
89 $appMeta = json_decode($appMetaJson, TRUE);
90 \Civi\Cxn\Rpc\AppMeta
::validate($appMeta);
95 * Parse the CIVICRM_CXN_CA constant. It may have the following
97 * - 'CiviRootCA'|undefined -- Use the production civicrm.org root CA
98 * - 'CiviTestRootCA' -- Use the test civicrm.org root CA
99 * - 'none' -- Do not perform any certificate verification.
101 * This constant is emphatically *not* exposed through Civi's "Settings"
102 * system (or any other runtime-editable datastore). Manipulating
103 * this setting can expose the system to man-in-the-middle attacks,
104 * and allowing runtime manipulation would create a new vector
105 * for escalating privileges. This setting must only be manipulated
106 * by developers and sysadmins who already have full privileges
107 * to edit the source.
109 * @return string|NULL
110 * The PEM-encoded root certificate. NULL if verification is disabled.
111 * @throws CRM_Core_Exception
113 public static function getCACert() {
114 if (!defined('CIVICRM_CXN_CA') || CIVICRM_CXN_CA
=== 'CiviRootCA') {
115 $file = Constants
::getCert();
117 elseif (CIVICRM_CXN_CA
=== 'CiviTestRootCA') {
118 $file = Constants
::getTestCert();
120 elseif (CIVICRM_CXN_CA
=== 'none') {
124 throw new \
CRM_Core_Exception("CIVICRM_CXN_CA is invalid.");
127 $content = file_get_contents($file);
128 if (empty($content)) {
129 // Fail hard. Returning an empty value is not acceptable.
130 throw new \
CRM_Core_Exception("Error loading CA certificate: $file");
136 * Construct a client for performing registration actions.
138 * @return \Civi\Cxn\Rpc\RegistrationClient
139 * @throws CRM_Core_Exception
141 public static function createRegistrationClient() {
142 $cxnStore = new \
CRM_Cxn_CiviCxnStore();
143 $viaPort = defined('CIVICRM_CXN_VIA') ? CIVICRM_CXN_VIA
: NULL;
144 $client = new \Civi\Cxn\Rpc\
RegistrationClient(
145 $cxnStore, \CRM_Cxn_BAO_Cxn
::getSiteCallbackUrl(), $viaPort);
146 $client->setLog(new \
CRM_Utils_SystemLogger());
147 $client->setCertValidator(self
::createCertificateValidator());
148 $client->setHttp(CRM_Cxn_CiviCxnHttp
::singleton());
153 * Construct a server for handling API requests.
155 * @return \Civi\Cxn\Rpc\ApiServer
157 public static function createApiServer() {
158 $cxnStore = new CRM_Cxn_CiviCxnStore();
159 $apiServer = new \Civi\Cxn\Rpc\
ApiServer($cxnStore);
160 $apiServer->setLog(new CRM_Utils_SystemLogger());
161 $apiServer->setCertValidator(self
::createCertificateValidator());
162 $apiServer->setHttp(CRM_Cxn_CiviCxnHttp
::singleton());
163 $apiServer->setRouter(array('CRM_Cxn_ApiRouter', 'route'));
168 * @return DefaultCertificateValidator
169 * @throws CRM_Core_Exception
171 public static function createCertificateValidator() {
172 $caCert = self
::getCACert();
173 if ($caCert === NULL) {
174 return new DefaultCertificateValidator(
182 return new DefaultCertificateValidator(
184 DefaultCertificateValidator
::AUTOLOAD
,
185 DefaultCertificateValidator
::AUTOLOAD
,
186 CRM_Cxn_CiviCxnHttp
::singleton()