CRM/Utils/REST.php

   1 <?php
   2 /*
   3    +--------------------------------------------------------------------+
   4    | CiviCRM version 4.5                                                |
   5    +--------------------------------------------------------------------+
   6    | Copyright CiviCRM LLC (c) 2004-2014                                |
   7    +--------------------------------------------------------------------+
   8    | This file is a part of CiviCRM.                                    |
   9    |                                                                    |
  10    | CiviCRM is free software; you can copy, modify, and distribute it  |
  11    | under the terms of the GNU Affero General Public License           |
  12    | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13    |                                                                    |
  14    | CiviCRM is distributed in the hope that it will be useful, but     |
  15    | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16    | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17    | See the GNU Affero General Public License for more details.        |
  18    |                                                                    |
  19    | You should have received a copy of the GNU Affero General Public   |
  20    | License and the CiviCRM Licensing Exception along                  |
  21    | with this program; if not, contact CiviCRM LLC                     |
  22    | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23    | GNU Affero General Public License or the licensing of CiviCRM,     |
  24    | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25    +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  * This class handles all REST client requests.
  30  *
  31  * @package CRM
  32  * @copyright CiviCRM LLC (c) 2004-2014
  33  *
  34  */
  35 class CRM_Utils_REST {
  36
  37   /**
  38    * Number of seconds we should let a REST process idle
  39    * @static
  40    */
  41   static $rest_timeout = 0;
  42
  43   /**
  44    * Cache the actual UF Class
  45    */
  46   public $ufClass;
  47
  48   /**
  49    * Class constructor.  This caches the real user framework class locally,
  50    * so we can use it for authentication and validation.
  51    *
  52    * @internal param string $uf The userframework class
  53    */
  54   public function __construct() {
  55     // any external program which call Rest Server is responsible for
  56     // creating and attaching the session
  57     $args = func_get_args();
  58     $this->ufClass = array_shift($args);
  59   }
  60
  61   /**
  62    * Simple ping function to test for liveness.
  63    *
  64    * @param string $var   The string to be echoed
  65    *
  66    * @return string       $var
  67    * @access public
  68    */
  69   public static function ping($var = NULL) {
  70     $session = CRM_Core_Session::singleton();
  71     $key = $session->get('key');
  72     //$session->set( 'key', $var );
  73     return self::simple(array('message' => "PONG: $key"));
  74   }
  75
  76   // Generates values needed for error messages
  77   /**
  78    * @param string $message
  79    *
  80    * @return array
  81    */
  82   static function error($message = 'Unknown Error') {
  83     $values = array(
  84       'error_message' => $message,
  85       'is_error' => 1,
  86     );
  87     return $values;
  88   }
  89
  90   // Generates values needed for non-error responses.
  91   /**
  92    * @param $params
  93    *
  94    * @return array
  95    */
  96   static function simple($params) {
  97     $values = array('is_error' => 0);
  98     $values += $params;
  99     return $values;
 100   }
 101
 102   /**
 103    * @return string
 104    */
 105   function run() {
 106     $result = self::handle();
 107     return self::output($result);
 108   }
 109
 110   /**
 111    * @return string
 112    */
 113   function bootAndRun() {
 114     $response = $this->loadCMSBootstrap();
 115     if (is_array($response)) {
 116       return self::output($response);
 117     }
 118     return $this->run();
 119   }
 120
 121   /**
 122    * @param $result
 123    *
 124    * @return string
 125    */
 126   static function output(&$result) {
 127     $requestParams = CRM_Utils_Request::exportValues();
 128
 129     $hier = FALSE;
 130     if (is_scalar($result)) {
 131       if (!$result) {
 132         $result = 0;
 133       }
 134       $result = self::simple(array('result' => $result));
 135     }
 136     elseif (is_array($result)) {
 137       if (CRM_Utils_Array::isHierarchical($result)) {
 138         $hier = TRUE;
 139       }
 140       elseif (!array_key_exists('is_error', $result)) {
 141         $result['is_error'] = 0;
 142       }
 143     }
 144     else {
 145       $result = self::error('Could not interpret return values from function.');
 146     }
 147
 148     if (CRM_Utils_Array::value('json', $requestParams)) {
 149       header('Content-Type: text/javascript');
 150       $json = json_encode(array_merge($result));
 151       if (CRM_Utils_Array::value('prettyprint', $requestParams)) {
 152         return self::jsonFormated($json);
 153       }
 154       return $json;
 155     }
 156
 157
 158     if (isset($result['count'])) {
 159
 160
 161       $count = ' count="' . $result['count'] . '" ';
 162
 163
 164     }
 165     else $count = "";
 166     $xml = "<?xml version=\"1.0\"?>
 167       <ResultSet xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" $count>
 168       ";
 169     // check if this is a single element result (contact_get etc)
 170     // or multi element
 171     if ($hier) {
 172       foreach ($result['values'] as $n => $v) {
 173         $xml .= "<Result>\n" . CRM_Utils_Array::xml($v) . "</Result>\n";
 174       }
 175     }
 176     else {
 177       $xml .= "<Result>\n" . CRM_Utils_Array::xml($result) . "</Result>\n";
 178     }
 179
 180     $xml .= "</ResultSet>\n";
 181     return $xml;
 182   }
 183
 184   /**
 185    * @param $json
 186    *
 187    * @return string
 188    */
 189   static function jsonFormated($json) {
 190     $tabcount   = 0;
 191     $result     = '';
 192     $inquote    = FALSE;
 193     $inarray    = FALSE;
 194     $ignorenext = FALSE;
 195
 196     $tab = "\t";
 197     $newline = "\n";
 198
 199     for ($i = 0; $i < strlen($json); $i++) {
 200       $char = $json[$i];
 201
 202       if ($ignorenext) {
 203         $result .= $char;
 204         $ignorenext = FALSE;
 205       }
 206       else {
 207         switch ($char) {
 208           case '{':
 209             if ($inquote) {
 210               $result .= $char;
 211             }
 212             else {
 213               $inarray = FALSE;
 214               $tabcount++;
 215               $result .= $char . $newline . str_repeat($tab, $tabcount);
 216             }
 217             break;
 218
 219           case '}':
 220             if ($inquote) {
 221               $result .= $char;
 222             }
 223             else {
 224               $tabcount--;
 225               $result = trim($result) . $newline . str_repeat($tab, $tabcount) . $char;
 226             }
 227             break;
 228
 229           case ',':
 230             if ($inquote || $inarray) {
 231               $result .= $char;
 232             }
 233             else $result .= $char . $newline . str_repeat($tab, $tabcount);
 234             break;
 235
 236           case '"':
 237             $inquote = !$inquote;
 238             $result .= $char;
 239             break;
 240
 241           case '\\':
 242             if ($inquote) {
 243               $ignorenext = TRUE;
 244             }
 245             $result .= $char;
 246             break;
 247
 248           case '[':
 249             $inarray = TRUE;
 250             $result .= $char;
 251             break;
 252
 253           case ']':
 254             $inarray = FALSE;
 255             $result .= $char;
 256             break;
 257
 258           default:
 259             $result .= $char;
 260         }
 261       }
 262     }
 263
 264     return $result;
 265   }
 266
 267   /**
 268    * @return array|int
 269    */
 270   static function handle() {
 271     $requestParams = CRM_Utils_Request::exportValues();
 272
 273     // Get the function name being called from the q parameter in the query string
 274     $q = CRM_Utils_array::value('q', $requestParams);
 275     // or for the rest interface, from fnName
 276     $r = CRM_Utils_array::value('fnName', $requestParams);
 277     if (!empty($r)) {
 278       $q = $r;
 279     }
 280     if (!empty($q)) {
 281       $args = explode('/', $q);
 282       // If the function isn't in the civicrm namespace, reject the request.
 283       if ($args[0] != 'civicrm') {
 284         return self::error('Unknown function invocation.');
 285       }
 286
 287       // If the query string is malformed, reject the request.
 288       // Does this mean it will reject it
 289       if ((count($args) != 3) && ($args[1] != 'ping')) {
 290         return self::error('Unknown function invocation.');
 291       }
 292       $store = NULL;
 293
 294       if ($args[1] == 'ping') {
 295         return self::ping();
 296       }
 297     } else {
 298       // or the new format (entity+action)
 299       $args = array();
 300       $args[0] = 'civicrm';
 301       $args[1] = CRM_Utils_array::value('entity', $requestParams);
 302       $args[2] = CRM_Utils_array::value('action', $requestParams);
 303     }
 304
 305
 306     // Everyone should be required to provide the server key, so the whole
 307     //  interface can be disabled in more change to the configuration file.
 308     // first check for civicrm site key
 309     if (!CRM_Utils_System::authenticateKey(FALSE)) {
 310       $docLink = CRM_Utils_System::docURL2("Managing Scheduled Jobs", TRUE, NULL, NULL, NULL, "wiki");
 311       $key = CRM_Utils_array::value('key', $requestParams);
 312       if (empty($key)) {
 313         return self::error("FATAL: mandatory param 'key' missing. More info at: " . $docLink);
 314       }
 315       return self::error("FATAL: 'key' is incorrect. More info at: " . $docLink);
 316     }
 317
 318
 319     // At this point we know we are not calling ping which does not require authentication.
 320     //  Therefore, at this point we need to make sure we're working with a trusted user.
 321     //  Valid users are those who provide a valid server key and API key
 322
 323     $valid_user = FALSE;
 324
 325     // Check and see if a valid secret API key is provided.
 326     $api_key = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST');
 327     if (!$api_key || strtolower($api_key) == 'null') {
 328       return self::error("FATAL: mandatory param 'api_key' (user key) missing");
 329     }
 330     $valid_user = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key');
 331
 332     // If we didn't find a valid user, die
 333     if (empty($valid_user)) {
 334       return self::error("User API key invalid");
 335     }
 336
 337     return self::process($args, self::buildParamList());
 338   }
 339
 340   /**
 341    * @param $args
 342    * @param $params
 343    *
 344    * @return array|int
 345    */
 346   static function process(&$args, $params) {
 347     $params['check_permissions'] = TRUE;
 348     $fnName = $apiFile = NULL;
 349     // clean up all function / class names. they should be alphanumeric and _ only
 350     for ($i = 1; $i <= 3; $i++) {
 351       if (!empty($args[$i])) {
 352         $args[$i] = CRM_Utils_String::munge($args[$i]);
 353       }
 354     }
 355
 356     // incase of ajax functions className is passed in url
 357     if (isset($params['className'])) {
 358       $params['className'] = CRM_Utils_String::munge($params['className']);
 359
 360       // functions that are defined only in AJAX.php can be called via
 361       // rest interface
 362       if (!CRM_Core_Page_AJAX::checkAuthz('method', $params['className'], $params['fnName'])) {
 363         return self::error('Unknown function invocation.');
 364       }
 365
 366       return call_user_func(array($params['className'], $params['fnName']), $params);
 367     }
 368
 369     if (!array_key_exists('version', $params)) {
 370       $params['version'] = 3;
 371     }
 372
 373     if ($params['version'] == 2) {
 374       $result['is_error'] = 1;
 375       $result['error_message'] = "FATAL: API v2 not accessible from ajax/REST";
 376       $result['deprecated'] = "Please upgrade to API v3";
 377       return $result;
 378     }
 379
 380     if ($_SERVER['REQUEST_METHOD'] == 'GET' && strtolower(substr( $args[2],0,3)) != 'get') {
 381       // get only valid for non destructive methods
 382       require_once 'api/v3/utils.php';
 383       return civicrm_api3_create_error("SECURITY: All requests that modify the database must be http POST, not GET.",
 384         array(
 385           'IP' => $_SERVER['REMOTE_ADDR'],
 386           'level' => 'security',
 387           'referer' => $_SERVER['HTTP_REFERER'],
 388           'reason' => 'Destructive HTTP GET',
 389         )
 390       );
 391     }
 392
 393     // trap all fatal errors
 394     $errorScope = CRM_Core_TemporaryErrorScope::create(array('CRM_Utils_REST', 'fatal'));
 395     $result = civicrm_api($args[1], $args[2], $params);
 396     unset($errorScope);
 397
 398     if ($result === FALSE) {
 399       return self::error('Unknown error.');
 400     }
 401     return $result;
 402   }
 403
 404   /**
 405    * @return array|mixed|null
 406    */
 407   static function &buildParamList() {
 408     $requestParams = CRM_Utils_Request::exportValues();
 409     $params = array();
 410
 411     $skipVars = array(
 412       'q' => 1,
 413       'json' => 1,
 414       'key' => 1,
 415       'api_key' => 1,
 416       'entity' => 1,
 417       'action' => 1,
 418     );
 419
 420     if (array_key_exists('json', $requestParams) &&  $requestParams['json'][0] == "{") {
 421       $params = json_decode($requestParams['json'], TRUE);
 422       if($params === NULL) {
 423         echo json_encode(array('is_error' => 1, 'error_message', 'Unable to decode supplied JSON.'));
 424         CRM_Utils_System::civiExit();
 425       }
 426     }
 427     foreach ($requestParams as $n => $v) {
 428       if (!array_key_exists($n, $skipVars)) {
 429         $params[$n] = $v;
 430       }
 431     }
 432     if (array_key_exists('return', $requestParams) && is_array($requestParams['return'])) {
 433       foreach ($requestParams['return'] as $key => $v) $params['return.' . $key] = 1;
 434     }
 435     return $params;
 436   }
 437
 438   /**
 439    * @param $pearError
 440    */
 441   static function fatal($pearError) {
 442     header('Content-Type: text/xml');
 443     $error = array();
 444     $error['code'] = $pearError->getCode();
 445     $error['error_message'] = $pearError->getMessage();
 446     $error['mode'] = $pearError->getMode();
 447     $error['debug_info'] = $pearError->getDebugInfo();
 448     $error['type'] = $pearError->getType();
 449     $error['user_info'] = $pearError->getUserInfo();
 450     $error['to_string'] = $pearError->toString();
 451     $error['is_error'] = 1;
 452
 453     echo self::output($error);
 454
 455     CRM_Utils_System::civiExit();
 456   }
 457
 458   static function APIDoc() {
 459
 460     CRM_Utils_System::setTitle("API Parameters");
 461     $template = CRM_Core_Smarty::singleton();
 462     return CRM_Utils_System::theme(
 463       $template->fetch('CRM/Core/APIDoc.tpl')
 464     );
 465   }
 466
 467   static function ajaxDoc() {
 468     return CRM_Utils_System::redirect(CRM_Utils_System::url('civicrm/api/explorer'));
 469   }
 470
 471   /** used to load a template "inline", eg. for ajax, without having to build a menu for each template */
 472   static  function loadTemplate () {
 473     $request = CRM_Utils_Request::retrieve( 'q', 'String');
 474     if (false !== strpos($request, '..')) {
 475       die ("SECURITY FATAL: the url can't contain '..'. Please report the issue on the forum at civicrm.org");
 476     }
 477
 478     $request = split ('/',$request);
 479     $entity = _civicrm_api_get_camel_name($request[2]);
 480     $tplfile=_civicrm_api_get_camel_name($request[3]);
 481
 482     $tpl = 'CRM/'.$entity.'/Page/Inline/'.$tplfile.'.tpl';
 483     $smarty= CRM_Core_Smarty::singleton( );
 484     CRM_Utils_System::setTitle( "$entity::$tplfile inline $tpl" );
 485     if( !$smarty->template_exists($tpl) ){
 486       header("Status: 404 Not Found");
 487       die ("Can't find the requested template file templates/$tpl");
 488     }
 489     if (array_key_exists('id',$_GET)) {// special treatmenent, because it's often used
 490       $smarty->assign ('id',(int)$_GET['id']);// an id is always positive
 491     }
 492     $pos = strpos (implode (array_keys ($_GET)),'<') ;
 493
 494     if ($pos !== false) {
 495       die ("SECURITY FATAL: one of the param names contains &lt;");
 496     }
 497     $param = array_map( 'htmlentities' , $_GET);
 498     unset($param['q']);
 499     $smarty->assign_by_ref("request", $param);
 500
 501     if  ( ! array_key_exists ( 'HTTP_X_REQUESTED_WITH', $_SERVER ) ||
 502       $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest"  )  {
 503
 504         $smarty->assign( 'tplFile', $tpl );
 505         $config = CRM_Core_Config::singleton();
 506         $content = $smarty->fetch( 'CRM/common/'. strtolower($config->userFramework) .'.tpl' );
 507
 508         if (!defined('CIVICRM_UF_HEAD') && $region = CRM_Core_Region::instance('html-header', FALSE)) {
 509           CRM_Utils_System::addHTMLHead($region->render(''));
 510         }
 511         CRM_Utils_System::appendTPLFile( $tpl, $content );
 512
 513         return CRM_Utils_System::theme($content);
 514
 515       } else {
 516         $content = "<!-- .tpl file embeded: $tpl -->\n";
 517         CRM_Utils_System::appendTPLFile( $tpl, $content );
 518         echo $content . $smarty->fetch ($tpl);
 519         CRM_Utils_System::civiExit( );
 520     }
 521   }
 522
 523   /** This is a wrapper so you can call an api via json (it returns json too)
 524    * http://example.org/civicrm/api/json?entity=Contact&action=Get"&json={"contact_type":"Individual","email.get.email":{}} to take all the emails from individuals
 525    * works for POST & GET (POST recommended)
 526    **/
 527   static function ajaxJson() {
 528     $requestParams = CRM_Utils_Request::exportValues();
 529
 530     require_once 'api/v3/utils.php';
 531     // Why is $config undefined -- $config = CRM_Core_Config::singleton();
 532     if (!$config->debug && (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) ||
 533         $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest"
 534       )) {
 535       $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().",
 536         array(
 537           'IP' => $_SERVER['REMOTE_ADDR'],
 538           'level' => 'security',
 539           'referer' => $_SERVER['HTTP_REFERER'],
 540           'reason' => 'CSRF suspected',
 541         )
 542       );
 543       echo json_encode($error);
 544       CRM_Utils_System::civiExit();
 545     }
 546     if (empty($requestParams['entity'])) {
 547       echo json_encode(civicrm_api3_create_error('missing entity param'));
 548       CRM_Utils_System::civiExit();
 549     }
 550     if (empty($requestParams['entity'])) {
 551       echo json_encode(civicrm_api3_create_error('missing entity entity'));
 552       CRM_Utils_System::civiExit();
 553     }
 554     if (!empty($requestParams['json'])) {
 555       $params = json_decode($requestParams['json'], TRUE);
 556     }
 557     $entity = CRM_Utils_String::munge(CRM_Utils_Array::value('entity', $requestParams));
 558     $action = CRM_Utils_String::munge(CRM_Utils_Array::value('action', $requestParams));
 559     if (!is_array($params)) {
 560       echo json_encode(array('is_error' => 1, 'error_message', 'invalid json format: ?{"param_with_double_quote":"value"}'));
 561       CRM_Utils_System::civiExit();
 562     }
 563
 564     $params['check_permissions'] = TRUE;
 565     $params['version'] = 3;
 566     $_GET['json'] = $requestParams['json'] = 1; // $requestParams is local-only; this line seems pointless unless there's a side-effect influencing other functions
 567     if (!$params['sequential']) {
 568       $params['sequential'] = 1;
 569     }
 570
 571     // trap all fatal errors
 572     $errorScope = CRM_Core_TemporaryErrorScope::create(array('CRM_Utils_REST', 'fatal'));
 573     $result = civicrm_api($entity, $action, $params);
 574     unset($errorScope);
 575
 576     echo self::output($result);
 577
 578     CRM_Utils_System::civiExit();
 579   }
 580
 581   static function ajax() {
 582     $requestParams = CRM_Utils_Request::exportValues();
 583
 584     // this is driven by the menu system, so we can use permissioning to
 585     // restrict calls to this etc
 586     // the request has to be sent by an ajax call. First line of protection against csrf
 587     $config = CRM_Core_Config::singleton();
 588     if (!$config->debug &&
 589       (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) ||
 590         $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest"
 591       )
 592     ) {
 593       require_once 'api/v3/utils.php';
 594       $error = civicrm_api3_create_error("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3().",
 595         array(
 596           'IP' => $_SERVER['REMOTE_ADDR'],
 597           'level' => 'security',
 598           'referer' => $_SERVER['HTTP_REFERER'],
 599           'reason' => 'CSRF suspected',
 600         )
 601       );
 602       echo json_encode($error);
 603       CRM_Utils_System::civiExit();
 604     }
 605
 606     $q = CRM_Utils_Array::value('fnName', $requestParams);
 607     if (!$q) {
 608       $entity = CRM_Utils_Array::value('entity', $requestParams);
 609       $action = CRM_Utils_Array::value('action', $requestParams);
 610       if (!$entity || !$action) {
 611         $err = array('error_message' => 'missing mandatory params "entity=" or "action="', 'is_error' => 1);
 612         echo self::output($err);
 613         CRM_Utils_System::civiExit();
 614       }
 615       $args = array('civicrm', $entity, $action);
 616     }
 617     else {
 618       $args = explode('/', $q);
 619     }
 620
 621     // get the class name, since all ajax functions pass className
 622     $className = CRM_Utils_Array::value('className', $requestParams);
 623
 624     // If the function isn't in the civicrm namespace, reject the request.
 625     if (($args[0] != 'civicrm' && count($args) != 3) && !$className) {
 626       return self::error('Unknown function invocation.');
 627     }
 628
 629     // Support for multiple api calls
 630     if (isset($entity) && $entity === 'api3') {
 631       $result = self::processMultiple();
 632     }
 633     else {
 634       $result = self::process($args, self::buildParamList());
 635     }
 636
 637     echo self::output($result);
 638
 639     CRM_Utils_System::civiExit();
 640   }
 641
 642   /**
 643    * Callback for multiple ajax api calls from CRM.api3()
 644    * @return array
 645    */
 646   static function processMultiple() {
 647     $output = array();
 648     foreach (json_decode($_REQUEST['json'], TRUE) as $key => $call) {
 649       $args = array(
 650         'civicrm',
 651         $call[0],
 652         $call[1],
 653       );
 654       $output[$key] = self::process($args, CRM_Utils_Array::value(2, $call, array()));
 655     }
 656     return $output;
 657   }
 658
 659   /**
 660    * @return array|NULL NULL if execution should proceed; array if the response is already known
 661    */
 662   function loadCMSBootstrap() {
 663     $requestParams = CRM_Utils_Request::exportValues();
 664     $q = CRM_Utils_array::value('q', $requestParams);
 665     $args = explode('/', $q);
 666
 667     // Proceed with bootstrap for "?entity=X&action=Y"
 668     // Proceed with bootstrap for "?q=civicrm/X/Y" but not "?q=civicrm/ping"
 669     if (!empty($q)) {
 670       if (count($args) == 2 && $args[1] == 'ping') {
 671         return NULL; // this is pretty wonky but maybe there's some reason I can't see
 672       }
 673       if (count($args) != 3) {
 674         return self::error('ERROR: Malformed REST path');
 675       }
 676       if ($args[0] != 'civicrm') {
 677         return self::error('ERROR: Malformed REST path');
 678       }
 679       // Therefore we have reasonably well-formed "?q=civicrm/X/Y"
 680     }
 681
 682     if (!CRM_Utils_System::authenticateKey(FALSE)) {
 683       // FIXME: At time of writing, this doesn't actually do anything because
 684       // authenticateKey abends, but that's a bad behavior which sends a
 685       // malformed response.
 686       return self::error('Failed to authenticate key');
 687     }
 688
 689     $uid = NULL;
 690     if (!$uid) {
 691       $store      = NULL;
 692       $api_key    = CRM_Utils_Request::retrieve('api_key', 'String', $store, FALSE, NULL, 'REQUEST');
 693       if (empty($api_key)) {
 694         return self::error("FATAL: mandatory param 'api_key' (user key) missing");
 695       }
 696       $contact_id = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $api_key, 'id', 'api_key');
 697       if ($contact_id) {
 698         $uid = CRM_Core_BAO_UFMatch::getUFId($contact_id);
 699       }
 700     }
 701
 702     if ($uid) {
 703       CRM_Utils_System::loadBootStrap(array('uid' => $uid), TRUE, FALSE);
 704       return NULL;
 705     }
 706     else {
 707       return self::error('ERROR: No CMS user associated with given api-key');
 708     }
 709   }
 710 }
 711