WordPress.org
Get WordPress

Plugin Directory

Changeset 329903


Ignore:
Timestamp:
01/07/2011 09:24:36 PM (15 years ago)
Author:
camdagr8
Message:

1.0.4

+ Added functionality to restrict API usage to specific domains per user via the wp user profile settings.

Location:
flash-api
Files:
14 added
5 edited

Legend:

Unmodified
Added
Removed

  • flash-api/trunk/flash_api.php

    r290063 r329903  
    33    Plugin Name: Flash API
    44    Description: This plugin serves as a faux webservice that outputs data from the WP Database to a flash application
    5     Version: 1.0.3
     5    Version: 1.0.4
    66    Author: Cameron Tullos - Illumifi Interactive
    77    Author URI: http://illumifi.net/
    … …  
    201201    function fapi_user_profile_hook($user) {
    202202        $apiKey = get_user_meta($user->ID, 'apiKey', true);
     203        $apiUrl = get_user_meta($user->ID, 'apiUrl', true);
    203204        $perm = current_user_can('add_users');
    204205        $readOnly = (!$perm) ? 'readonly="readonly"' : '';
    … …  
    209210        <table class="form-table">
    210211            <tr>
    211                 <th><label for="apilabel">API Key</label></th>
     212                <th><label>API Domain</label></th>
     213                <td><input type="text" name="flash_api_url" id="flash_api_url" value="'.$apiUrl.'" class="regular-text" '.$readOnly.' /><i>Example: '.$_SERVER['HTTP_HOST'].'</td>
     214            </tr>
     215            <tr>
     216                <th><label>API Key</label></th>
    212217                <td><input type="text" name="flash_api_key" id="flash_api_key" value="'.$apiKey.'" class="regular-text" '.$readOnly.' />';
    213218                if ($perm) { echo '<input type="button" class="button-secondary" name="generate" id="generate" value="'.__("Generate").'" /></td>'; }
    … …  
    221226   
    222227    function fapi_apiKey_save($user_id) {
    223         if (!current_user_can('edit_user', $user_id )) { return false; }   
    224         update_usermeta($user_id, 'apiKey', $_POST['flash_api_key']);
     228        if (!current_user_can('edit_user', $user_id )) { return false; }
     229       
     230        $apiKey = $_POST['flash_api_key'];
     231        $apiUrl = $_POST['flash_api_url'];
     232        $apiUrl = str_replace('https://', '', $apiUrl);
     233        $apiUrl = str_replace('http://', '', $apiUrl);
     234        $apiUrlARR = explode('/', $apiUrl);
     235        $apiUrl = $apiUrlARR[0];
     236       
     237        update_usermeta($user_id, 'apiUrl', $apiUrl);
     238        update_usermeta($user_id, 'apiKey', $apiKey);
    225239    }
    226240?>

  • flash-api/trunk/js/flash_api.js

    r266138 r329903  
    66
    77            var chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz";
     8            var http = $('flash_api_url').val();
    89
    910            var string_length = 8;
    … …  
    1920            }
    2021
    21             return MD5(randomstring);
     22            return MD5(http + randomstring);
    2223
    2324        }

  • flash-api/trunk/readme.txt

    r290063 r329903  
    44Requires at least: 2.0.2
    55Tested up to: 3.0
    6 Stable tag: 1.0.3
     6Stable tag: 1.0.4
    77
    88This plugin serves as a faux web service that outputs data from the WP Database to a Flash application in any way you wish.
    … …  
    1515This plugin insures that the connecting party is a valid user of the API before outputing any data or executing a function.
    1616<br><br>
    17 <i>* Note: PHP and WordPress knowledge is required to create your own functions and data outputs.</i>
     17<i>* PHP and WordPress knowledge is required to create your own functions and data outputs.</i><br>
     18<i> ** Be sure to backup your services.php file when updating to newer versions of the plugin.</i>
    1819
    1920
    … …  
    5556* Fixed User profile ability to change own API Key if non-admin. Only 'add_user' level users can edit individual API Keys.
    5657
    57 
     58= 1.0.4 =
     59+ Added functionality to restrict API usage to specific domains.

  • flash-api/trunk/services.php

    r272739 r329903  
    118118    $limit = ($_REQUEST['limit']) ? $_REQUEST['limit'] : 20;
    119119   
    120     $sql = "SELECT post.post_content, post.post_excerpt, post.post_title, post.post_date, post.guid, user.user_nicename
     120    $sql = "SELECT post.ID, post.post_content, post.post_excerpt, post.post_title, post.post_date, post.guid, user.user_nicename
    121121        FROM ".$wpdb->posts." AS post
    122122        JOIN ".$wpdb->users." AS user
    … …  
    130130    $rows = $wpdb->get_results($sql);
    131131    foreach($rows as $row) {
    132         $xml .= nodeWrap("<node title='".$row->post_title."' date='".$row->post_date."' link='".$row->guid."' author='".$row->user_nicename."' thumbnail=''>\r\t\t<![CDATA[".$row->post_content."]]>\r\t</node>");
     132        $xml .= nodeWrap("<node id='".$row->ID."' title='".$row->post_title."' date='".$row->post_date."' link='".get_permalink($row->ID)."' author='".$row->user_nicename."'>\r\t\t<![CDATA[".$row->post_content."]]>\r\t</node>");
    133133    }
    134134    return xmlWrap($xml);

  • flash-api/trunk/wsrv.php

    r266138 r329903  
    22
    33error_reporting(E_ERROR | E_PARSE);
    4 
    5 
    6 
    74define('SITEROOT', '../../../');
    85
    9 
    10 
    116require_once(SITEROOT . 'wp-config.php');
    12 
    137require_once(SITEROOT . 'wp-load.php');
    14 
    158require_once(SITEROOT . 'wp-includes/wp-db.php');
    16 
    17 
    189
    1910// Initiate
    … …  
    2112do_service();
    2213
    23 
    24 
    25 
    26 
    2714function xmlWrap($nodes) {
    28 
    2915    header("Content-type: text/xml");
    30 
    3116    $xml = "<?xml version='1.0' encoding='utf-8'?>\r";
    32 
    3317    $xml .= "<data>\r";
    34 
    3518    $xml .= $nodes;
    36 
    3719    $xml .= "</data>";
    38 
    3920    return $xml;
    40 
    4121}
    42 
    43 
    4422
    4523function nodeWrap($node) {
    … …  
    5432
    5533function do_service() {
    56 
    5734    include('services.php');
    5835
    59 
    60 
    6136    /**
    62 
    6337     * API KEY CHECK   
    64 
    6538     */
    66 
    67 
    68 
    6939    global $wpdb;
    7040
    7141    $sql = $wpdb->prepare("SELECT option_value from ".$wpdb->options." WHERE option_name = 'flash_api_key'");
    72 
    7342    $apiKey = $wpdb->get_var($sql);
    74 
     43    $key = $_REQUEST['apiKey'];
    7544    $service = $_REQUEST['service'];
    7645
    77 
    78 
    79     if ($_REQUEST['apiKey'] != $apiKey) {
    80 
    81         echo xmlWrap('<node error="true" param="apiKey" msg="INVALID API KEY" />');
    82 
    83         return;
    84 
     46    if ($key != $apiKey) {// key isn't global
     47       
     48        if (is_ApiUser($key) != true) { // key isn't user based
     49            echo xmlWrap('<node error="true" param="apiKey" msg="INVALID API KEY" />');
     50            return;
     51        }
     52        else { // key was user based
     53            if (function_exists($service)) { echo $service(); }
     54            else { echo xmlWrap('<node error="true" param="service" msg="INVALID SERVICE" />'); }
     55        }
    8556    }
    8657
    87    
    88 
    89    
    90 
    9158    /**
    92 
    9359     * FUNCTION EXECUTION
    94 
    9560     */
    96 
    97     else {
    98 
    99         $func = $_REQUEST['service'];
    100 
    101         if (function_exists($func)) { echo $func(); }
    102 
     61    else { // key was global
     62        if (function_exists($service)) { echo $service(); }
    10363        else { echo xmlWrap('<node error="true" param="service" msg="INVALID SERVICE" />'); }
    104 
    10564    }
    106 
    10765}
    10866
    109 
    110 
    111 
    112 
    113 
    114 
     67function is_ApiUser($key) {
     68    global $wpdb;
     69   
     70    $domain = $_REQUEST['domain'];
     71    if (!$domain) { $domain = $_SERVER['HTTP_HOST']; }
     72       
     73    $users = $wpdb->get_results("SELECT ID FROM $wpdb->users"); // query users
     74    foreach($users as $user) {
     75        $ukey = get_user_meta($user->ID, 'apiKey', true);   
     76        $http = get_user_meta($user->ID, 'apiUrl', true);
     77       
     78        if ($http == $domain && $ukey == $key) { return true; }
     79    }
     80   
     81    return false;
     82}
    11583?>
Note: See TracChangeset for help on using the changeset viewer.