3 +--------------------------------------------------------------------+
4 | Copyright CiviCRM LLC. All rights reserved. |
6 | This work is published under the GNU AGPLv3 license with some |
7 | permitted exceptions and without any warranty. For full license |
8 | and copyright information, see https://civicrm.org/licensing |
9 +--------------------------------------------------------------------+
13 * This class handles all REST client requests.
16 * @copyright CiviCRM LLC https://civicrm.org/licensing
18 class CRM_Utils_REST
{
21 * Number of seconds we should let a REST process idle
24 public static $rest_timeout = 0;
27 * Cache the actual UF Class
33 * Class constructor. This caches the real user framework class locally,
34 * so we can use it for authentication and validation.
36 * @internal param string $uf The userframework class
38 public function __construct() {
39 // any external program which call Rest Server is responsible for
40 // creating and attaching the session
41 $args = func_get_args();
42 $this->ufClass
= array_shift($args);
46 * Simple ping function to test for liveness.
49 * The string to be echoed.
53 public static function ping($var = NULL) {
54 $session = CRM_Core_Session
::singleton();
55 $key = $session->get('key');
56 // $session->set( 'key', $var );
57 return self
::simple(['message' => "PONG: $key"]);
61 * Generates values needed for error messages.
62 * @param string $message
66 public static function error($message = 'Unknown Error') {
68 'error_message' => $message,
75 * Generates values needed for non-error responses.
76 * @param array $params
80 public static function simple($params) {
81 $values = ['is_error' => 0];
89 public function run() {
90 $result = self
::handle();
91 return self
::output($result);
97 public function bootAndRun() {
98 $response = $this->loadCMSBootstrap();
99 if (is_array($response)) {
100 return self
::output($response);
110 public static function output(&$result) {
111 $requestParams = CRM_Utils_Request
::exportValues();
114 if (is_scalar($result)) {
118 $result = self
::simple(['result' => $result]);
120 elseif (is_array($result)) {
121 if (CRM_Utils_Array
::isHierarchical($result)) {
124 elseif (!array_key_exists('is_error', $result)) {
125 $result['is_error'] = 0;
129 $result = self
::error('Could not interpret return values from function.');
132 if (!empty($requestParams['json'])) {
133 if (!empty($requestParams['prettyprint'])) {
134 // Don't set content-type header for api explorer output
135 return json_encode(array_merge($result), JSON_PRETTY_PRINT + JSON_UNESCAPED_SLASHES + JSON_UNESCAPED_UNICODE
);
136 return self
::jsonFormated(array_merge($result));
138 CRM_Utils_System
::setHttpHeader('Content-Type', 'application/json');
139 return json_encode(array_merge($result));
142 if (isset($result['count'])) {
143 $count = ' count="' . $result['count'] . '" ';
148 $xml = "<?xml version=\"1.0\"?>
149 <ResultSet xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" $count>
151 // check if this is a single element result (contact_get etc)
154 foreach ($result['values'] as $k => $v) {
156 $xml .= "<Result>\n" . CRM_Utils_Array
::xml($v) . "</Result>\n";
158 elseif (!is_object($v)) {
159 $xml .= "<Result>\n<id>{$k}</id><value>{$v}</value></Result>\n";
164 $xml .= "<Result>\n" . CRM_Utils_Array
::xml($result) . "</Result>\n";
167 $xml .= "</ResultSet>\n";
174 public static function handle() {
175 $requestParams = CRM_Utils_Request
::exportValues();
177 // Get the function name being called from the q parameter in the query string
178 $q = $requestParams['q'] ??
NULL;
179 // or for the rest interface, from fnName
180 $r = $requestParams['fnName'] ??
NULL;
184 $entity = $requestParams['entity'] ??
NULL;
185 if (empty($entity) && !empty($q)) {
186 $args = explode('/', $q);
187 // If the function isn't in the civicrm namespace, reject the request.
188 if ($args[0] != 'civicrm') {
189 return self
::error('Unknown function invocation.');
192 // If the query string is malformed, reject the request.
193 // Does this mean it will reject it
194 if ((count($args) != 3) && ($args[1] != 'ping')) {
195 return self
::error('Unknown function invocation.');
199 if ($args[1] == 'ping') {
204 // or the api format (entity+action)
206 $args[0] = 'civicrm';
207 $args[1] = $requestParams['entity'] ??
NULL;
208 $args[2] = $requestParams['action'] ??
NULL;
211 // Everyone should be required to provide the server key, so the whole
212 // interface can be disabled in more change to the configuration file.
213 // first check for civicrm site key
214 if (!CRM_Utils_System
::authenticateKey(FALSE)) {
215 $docLink = CRM_Utils_System
::docURL2('sysadmin/setup/jobs', TRUE);
216 $key = $requestParams['key'] ??
NULL;
218 return self
::error("FATAL: mandatory param 'key' missing. More info at: " . $docLink);
220 return self
::error("FATAL: 'key' is incorrect. More info at: " . $docLink);
223 // At this point we know we are not calling ping which does not require authentication.
224 // Therefore we now need a valid server key and API key.
225 // Check and see if a valid secret API key is provided.
226 $api_key = CRM_Utils_Request
::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST');
227 if (!$api_key ||
strtolower($api_key) == 'null') {
228 return self
::error("FATAL: mandatory param 'api_key' (user key) missing");
230 $valid_user = CRM_Core_DAO
::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key');
232 // If we didn't find a valid user, die
233 if (empty($valid_user)) {
234 return self
::error("User API key invalid");
237 return self
::process($args, self
::buildParamList());
242 * @param array $params
246 public static function process(&$args, $params) {
247 $params['check_permissions'] = TRUE;
248 $fnName = $apiFile = NULL;
249 // clean up all function / class names. they should be alphanumeric and _ only
250 for ($i = 1; $i <= 3; $i++
) {
251 if (!empty($args[$i])) {
252 $args[$i] = CRM_Utils_String
::munge($args[$i]);
256 // incase of ajax functions className is passed in url
257 if (isset($params['className'])) {
258 $params['className'] = CRM_Utils_String
::munge($params['className']);
260 // functions that are defined only in AJAX.php can be called via
262 if (!CRM_Core_Page_AJAX
::checkAuthz('method', $params['className'], $params['fnName'])) {
263 return self
::error('Unknown function invocation.');
266 return call_user_func([$params['className'], $params['fnName']], $params);
269 if (!array_key_exists('version', $params)) {
270 $params['version'] = 3;
273 if ($params['version'] == 2) {
274 $result['is_error'] = 1;
275 $result['error_message'] = "FATAL: API v2 not accessible from ajax/REST";
276 $result['deprecated'] = "Please upgrade to API v3";
280 if ($_SERVER['REQUEST_METHOD'] == 'GET' &&
281 strtolower(substr($args[2], 0, 3)) != 'get' &&
282 strtolower($args[2] != 'check')) {
283 // get only valid for non destructive methods
284 require_once 'api/v3/utils.php';
285 return civicrm_api3_create_error("SECURITY: All requests that modify the database must be http POST, not GET.",
287 'IP' => $_SERVER['REMOTE_ADDR'],
288 'level' => 'security',
289 'referer' => $_SERVER['HTTP_REFERER'],
290 'reason' => 'Destructive HTTP GET',
295 // trap all fatal errors
296 $errorScope = CRM_Core_TemporaryErrorScope
::create([
300 $result = civicrm_api($args[1], $args[2], $params);
303 if ($result === FALSE) {
304 return self
::error('Unknown error.');
310 * @return array|mixed|null
312 public static function &buildParamList() {
313 $requestParams = CRM_Utils_Request
::exportValues();
325 if (array_key_exists('json', $requestParams) && $requestParams['json'][0] == "{") {
326 $params = json_decode($requestParams['json'], TRUE);
327 if ($params === NULL) {
328 CRM_Utils_JSON
::output([
330 0 => 'error_message',
331 1 => 'Unable to decode supplied JSON.',
335 foreach ($requestParams as $n => $v) {
336 if (!array_key_exists($n, $skipVars)) {
340 if (array_key_exists('return', $requestParams) && is_array($requestParams['return'])) {
341 foreach ($requestParams['return'] as $key => $v) {
342 $params['return.' . $key] = 1;
351 public static function fatal($pearError) {
352 CRM_Utils_System
::setHttpHeader('Content-Type', 'text/xml');
354 $error['code'] = $pearError->getCode();
355 $error['error_message'] = $pearError->getMessage();
356 $error['mode'] = $pearError->getMode();
357 $error['debug_info'] = $pearError->getDebugInfo();
358 $error['type'] = $pearError->getType();
359 $error['user_info'] = $pearError->getUserInfo();
360 $error['to_string'] = $pearError->toString();
361 $error['is_error'] = 1;
363 echo self
::output($error);
365 CRM_Utils_System
::civiExit();
369 * used to load a template "inline", eg. for ajax, without having to build a menu for each template
371 public static function loadTemplate() {
372 $request = CRM_Utils_Request
::retrieve('q', 'String');
373 if (FALSE !== strpos($request, '..')) {
374 die("SECURITY FATAL: the url can't contain '..'. Please report the issue on the forum at civicrm.org");
377 $request = explode('/', $request);
378 $entity = _civicrm_api_get_camel_name($request[2]);
379 $tplfile = _civicrm_api_get_camel_name($request[3]);
381 $tpl = 'CRM/' . $entity . '/Page/Inline/' . $tplfile . '.tpl';
382 $smarty = CRM_Core_Smarty
::singleton();
383 CRM_Utils_System
::setTitle("$entity::$tplfile inline $tpl");
384 if (!$smarty->template_exists($tpl)) {
385 CRM_Utils_System
::setHttpHeader("Status", "404 Not Found");
386 die("Can't find the requested template file templates/$tpl");
388 // special treatmenent, because it's often used
389 if (array_key_exists('id', $_GET)) {
390 // an id is always positive
391 $smarty->assign('id', (int) $_GET['id']);
393 $pos = strpos(implode(array_keys($_GET)), '<');
395 if ($pos !== FALSE) {
396 die("SECURITY FATAL: one of the param names contains <");
398 $param = array_map('htmlentities', $_GET);
400 $smarty->assign_by_ref("request", $param);
402 if (!self
::isWebServiceRequest()) {
404 $smarty->assign('tplFile', $tpl);
405 $config = CRM_Core_Config
::singleton();
406 $content = $smarty->fetch('CRM/common/' . strtolower($config->userFramework
) . '.tpl');
408 if (!defined('CIVICRM_UF_HEAD') && $region = CRM_Core_Region
::instance('html-header', FALSE)) {
409 CRM_Utils_System
::addHTMLHead($region->render(''));
411 CRM_Utils_System
::appendTPLFile($tpl, $content);
413 return CRM_Utils_System
::theme($content);
417 $content = "<!-- .tpl file embedded: $tpl -->\n";
418 CRM_Utils_System
::appendTPLFile($tpl, $content);
419 echo $content . $smarty->fetch($tpl);
420 CRM_Utils_System
::civiExit();
425 * This is a wrapper so you can call an api via json (it returns json too)
426 * http://example.org/civicrm/api/json?entity=Contact&action=Get"&json={"contact_type":"Individual","email.get.email":{}}
427 * to take all the emails from individuals.
428 * Works for POST & GET (POST recommended).
430 public static function ajaxJson() {
431 $requestParams = CRM_Utils_Request
::exportValues();
433 require_once 'api/v3/utils.php';
434 $config = CRM_Core_Config
::singleton();
435 if (!$config->debug
&& !self
::isWebServiceRequest()) {
436 $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().",
438 'IP' => $_SERVER['REMOTE_ADDR'],
439 'level' => 'security',
440 'referer' => $_SERVER['HTTP_REFERER'],
441 'reason' => 'CSRF suspected',
444 CRM_Utils_JSON
::output($error);
446 if (empty($requestParams['entity'])) {
447 CRM_Utils_JSON
::output(civicrm_api3_create_error('missing entity param'));
449 if (empty($requestParams['entity'])) {
450 CRM_Utils_JSON
::output(civicrm_api3_create_error('missing entity entity'));
452 if (!empty($requestParams['json'])) {
453 $params = json_decode($requestParams['json'], TRUE);
455 $entity = CRM_Utils_String
::munge(CRM_Utils_Array
::value('entity', $requestParams));
456 $action = CRM_Utils_String
::munge(CRM_Utils_Array
::value('action', $requestParams));
457 if (!is_array($params)) {
458 CRM_Utils_JSON
::output([
460 'error_message' => 'invalid json format: ?{"param_with_double_quote":"value"}',
464 $params['check_permissions'] = TRUE;
465 $params['version'] = 3;
466 // $requestParams is local-only; this line seems pointless unless there's a side-effect influencing other functions
467 $_GET['json'] = $requestParams['json'] = 1;
468 if (!$params['sequential']) {
469 $params['sequential'] = 1;
472 // trap all fatal errors
473 $errorScope = CRM_Core_TemporaryErrorScope
::create([
477 $result = civicrm_api($entity, $action, $params);
480 echo self
::output($result);
482 CRM_Utils_System
::civiExit();
490 public static function ajax() {
491 $requestParams = CRM_Utils_Request
::exportValues();
493 // this is driven by the menu system, so we can use permissioning to
494 // restrict calls to this etc
495 // the request has to be sent by an ajax call. First line of protection against csrf
496 $config = CRM_Core_Config
::singleton();
497 if (!$config->debug
&& !self
::isWebServiceRequest()) {
498 require_once 'api/v3/utils.php';
499 $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().",
501 'IP' => $_SERVER['REMOTE_ADDR'],
502 'level' => 'security',
503 'referer' => $_SERVER['HTTP_REFERER'],
504 'reason' => 'CSRF suspected',
507 CRM_Utils_JSON
::output($error);
510 $q = $requestParams['fnName'] ??
NULL;
512 $entity = $requestParams['entity'] ??
NULL;
513 $action = $requestParams['action'] ??
NULL;
514 if (!$entity ||
!$action) {
516 'error_message' => 'missing mandatory params "entity=" or "action="',
519 echo self
::output($err);
520 CRM_Utils_System
::civiExit();
522 $args = ['civicrm', $entity, $action];
525 $args = explode('/', $q);
528 // get the class name, since all ajax functions pass className
529 $className = $requestParams['className'] ??
NULL;
531 // If the function isn't in the civicrm namespace, reject the request.
532 if (($args[0] != 'civicrm' && count($args) != 3) && !$className) {
533 return self
::error('Unknown function invocation.');
536 // Support for multiple api calls
537 if (isset($entity) && $entity === 'api3') {
538 $result = self
::processMultiple();
541 $result = self
::process($args, self
::buildParamList());
544 echo self
::output($result);
546 CRM_Utils_System
::civiExit();
550 * Callback for multiple ajax api calls from CRM.api3()
553 public static function processMultiple() {
555 foreach (json_decode($_REQUEST['json'], TRUE) as $key => $call) {
561 $output[$key] = self
::process($args, CRM_Utils_Array
::value(2, $call, []));
568 * NULL if execution should proceed; array if the response is already known
570 public function loadCMSBootstrap() {
571 $requestParams = CRM_Utils_Request
::exportValues();
572 $q = $requestParams['q'] ??
NULL;
573 $args = explode('/', $q);
575 // Proceed with bootstrap for "?entity=X&action=Y"
576 // Proceed with bootstrap for "?q=civicrm/X/Y" but not "?q=civicrm/ping"
578 if (count($args) == 2 && $args[1] == 'ping') {
579 CRM_Utils_System
::loadBootStrap([], FALSE, FALSE);
580 // this is pretty wonky but maybe there's some reason I can't see
583 if (count($args) != 3) {
584 return self
::error('ERROR: Malformed REST path');
586 if ($args[0] != 'civicrm') {
587 return self
::error('ERROR: Malformed REST path');
589 // Therefore we have reasonably well-formed "?q=civicrm/X/Y"
592 if (!CRM_Utils_System
::authenticateKey(FALSE)) {
593 // FIXME: At time of writing, this doesn't actually do anything because
594 // authenticateKey abends, but that's a bad behavior which sends a
595 // malformed response.
596 CRM_Utils_System
::loadBootStrap([], FALSE, FALSE);
597 return self
::error('Failed to authenticate key');
603 $api_key = CRM_Utils_Request
::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST');
604 if (empty($api_key)) {
605 CRM_Utils_System
::loadBootStrap([], FALSE, FALSE);
606 return self
::error("FATAL: mandatory param 'api_key' (user key) missing");
608 $contact_id = CRM_Core_DAO
::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key');
610 $uid = CRM_Core_BAO_UFMatch
::getUFId($contact_id);
614 if ($uid && $contact_id) {
615 CRM_Utils_System
::loadBootStrap(['uid' => $uid], TRUE, FALSE);
616 $session = CRM_Core_Session
::singleton();
617 $session->set('ufID', $uid);
618 $session->set('userID', $contact_id);
619 CRM_Core_DAO
::executeQuery('SET @civicrm_user_id = %1',
620 [1 => [$contact_id, 'Integer']]
625 CRM_Utils_System
::loadBootStrap([], FALSE, FALSE);
626 return self
::error('ERROR: No CMS user associated with given api-key');
631 * Does this request appear to be a web-service request?
633 * It is important to distinguish regular browser-page-loads from web-service-requests. Regular
634 * page-loads can be CSRF vectors, and we don't web-services to run via CSRF.
637 * TRUE if the current request appears to either XMLHttpRequest or non-browser-based.
638 * Indicated by either (a) custom headers like `X-Request-With`/`X-Civi-Auth`
639 * or (b) strong-secret-params that could theoretically appear in URL bar but which
640 * cannot be meaningfully forged for CSRF purposes (like `?api_key=SECRET` or `?_authx=SECRET`).
641 * FALSE if the current request looks like a standard browser request. This request may be generated by
642 * <A HREF>, <IFRAME>, <IMG>, `Location:`, or similar CSRF vector.
644 public static function isWebServiceRequest(): bool {
645 if (($_SERVER['HTTP_X_REQUESTED_WITH'] ??
NULL) === 'XMLHttpRequest') {
649 // If authx is enabled, and if the user gives a credential, it will store metadata.
650 $authx = \CRM_Core_Session
::singleton()->get('authx');
652 // Some flows are resistant to CSRF. Allow these:
654 // <legacyrest> Current request has valid `?api_key=SECRET&key=SECRET` ==> Strong-secret params
657 // <param> Current request has valid `?_authx=SECRET` ==> Strong-secret param
660 // <xheader> Current request has valid `X-Civi-Auth:` ==> Custom header AND strong-secret param
663 // Other flows are not resistant to CSRF on their own (need combo w/`X-Requested-With:`).
665 // <login> Relies on a session `Cookie:` (which browsers re-send automatically).
666 // <auto> First request might be resistant, but all others use session `Cookie:`.
667 // <header> Browsers often retain list of credentials and re-send automatically.
670 if (!empty($authx) && in_array($authx['flow'], $allowFlows)) {