actions/api.php

   1 <?php
   2 /*
   3  * Laconica - a distributed open-source microblogging tool
   4  * Copyright (C) 2008, Controlez-Vous, Inc.
   5  *
   6  * This program is free software: you can redistribute it and/or modify
   7  * it under the terms of the GNU Affero General Public License as published by
   8  * the Free Software Foundation, either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU Affero General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Affero General Public License
  17  * along with this program.      If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 if (!defined('LACONICA')) { exit(1); }
  21
  22 class ApiAction extends Action {
  23
  24         var $user;
  25         var $content_type;
  26         var $api_arg;
  27         var $api_method;
  28         var $api_action;
  29
  30         function handle($args) {
  31                 parent::handle($args);
  32
  33                 $this->api_action = $this->arg('apiaction');
  34                 $method = $this->arg('method');
  35                 $argument = $this->arg('argument');
  36
  37                 if (isset($argument)) {
  38                         $cmdext = explode('.', $argument);
  39                         $this->api_arg =  $cmdext[0];
  40                         $this->api_method = $method;
  41                         $this->content_type = strtolower($cmdext[1]);
  42                 } else {
  43
  44                         # Requested format / content-type will be an extension on the method
  45                         $cmdext = explode('.', $method);
  46                         $this->api_method = $cmdext[0];
  47                         $this->content_type = strtolower($cmdext[1]);
  48                 }
  49
  50                 if($this->requires_auth()) {
  51                         if (!isset($_SERVER['PHP_AUTH_USER'])) {
  52
  53                                 # This header makes basic auth go
  54                                 header('WWW-Authenticate: Basic realm="Laconica API"');
  55
  56                                 # If the user hits cancel -- bam!
  57                                 $this->show_basic_auth_error();
  58                         } else {
  59                                 $nickname = $_SERVER['PHP_AUTH_USER'];
  60                                 $password = $_SERVER['PHP_AUTH_PW'];
  61                                 $user = common_check_user($nickname, $password);
  62
  63                                 if ($user) {
  64                                         $this->user = $user;
  65                                         $this->process_command();
  66                                 } else {
  67                                         # basic authentication failed
  68                                         $this->show_basic_auth_error();
  69                                 }
  70                         }
  71                 } else {
  72
  73                         # Caller might give us a username even if not required
  74                         if (isset($_SERVER['PHP_AUTH_USER'])) {
  75                                 $user = User::staticGet('nickname', $_SERVER['PHP_AUTH_USER']);
  76                                 if ($user) {
  77                                         $this->user = $user;
  78                                 }
  79                                 # Twitter doesn't throw an error if the user isn't found
  80                         }
  81
  82                         $this->process_command();
  83                 }
  84         }
  85
  86         function process_command() {
  87                 $action = "twitapi$this->api_action";
  88                 $actionfile = INSTALLDIR."/actions/$action.php";
  89
  90                 if (file_exists($actionfile)) {
  91                         require_once($actionfile);
  92                         $action_class = ucfirst($action)."Action";
  93                         $action_obj = new $action_class();
  94
  95                         if (method_exists($action_obj, $this->api_method)) {
  96                                 $apidata = array(       'content-type' => $this->content_type,
  97                                                                         'api_method' => $this->api_method,
  98                                                                         'api_arg' => $this->api_arg,
  99                                                                         'user' => $this->user);
 100
 101                                 call_user_func(array($action_obj, $this->api_method), $_REQUEST, $apidata);
 102                         } else {
 103                                 common_user_error("API method not found!", $code=404);
 104                         }
 105                 } else {
 106                         common_user_error("API method not found!", $code=404);
 107                 }
 108         }
 109
 110         # Whitelist of API methods that don't need authentication
 111         function requires_auth() {
 112                 static $noauth = array( 'statuses/public_timeline',
 113                                                                 'statuses/show',
 114                                                                 'users/show',
 115                                                                 'help/test',
 116                                                                 'help/downtime_schedule');
 117
 118                 static $bareauth = array('statuses/user_timeline',
 119                                                                  'statuses/friends',
 120                                                                  'statuses/followers',
 121                                                                  'favorites/favorites');
 122
 123                 $fullname = "$this->api_action/$this->api_method";
 124
 125                 if (in_array($fullname, $bareauth)) {
 126                         # bareauth: only needs auth if without an argument
 127                         if ($this->api_arg) {
 128                                 return false;
 129                         } else {
 130                                 return true;
 131                         }
 132                 } else if (in_array($fullname, $noauth)) {
 133                         # noauth: never needs auth
 134                         return false;
 135                 } else {
 136                         # everybody else needs auth
 137                         return true;
 138                 }
 139         }
 140
 141         function show_basic_auth_error() {
 142                 header('HTTP/1.1 401 Unauthorized');
 143                 $msg = 'Could not authenticate you.';
 144
 145                 if ($this->content_type == 'xml') {
 146                         header('Content-Type: application/xml; charset=utf-8');
 147                         common_start_xml();
 148                         common_element_start('hash');
 149                         common_element('error', NULL, $msg);
 150                         common_element('request', NULL, $_SERVER['REQUEST_URI']);
 151                         common_element_end('hash');
 152                         common_end_xml();
 153                 } else if ($this->content_type == 'json')  {
 154                         header('Content-Type: application/json; charset=utf-8');
 155                         $error_array = array('error' => $msg, 'request' => $_SERVER['REQUEST_URI']);
 156                         print(json_encode($error_array));
 157                 } else {
 158                         header('Content-type: text/plain');
 159                         print "$msg\n";
 160                 }
 161         }
 162
 163         function is_readonly() {
 164                 # NOTE: before handle(), can't use $this->arg
 165                 $apiaction = $_REQUEST['apiaction'];
 166                 $method = $_REQUEST['method'];
 167                 list($cmdtext, $fmt) = explode('.', $method);
 168
 169                 static $write_methods = array(
 170                         'account' => array('update_location', 'update_delivery_device', 'end_session'),
 171                         'blocks' => array('create', 'destroy'),
 172                         'direct_messages' => array('create', 'destroy'),
 173                         'favorites' => array('create', 'destroy'),
 174                         'friendships' => array('create', 'destroy'),
 175                         'help' => array(),
 176                         'notifications' => array('follow', 'leave'),
 177                         'statuses' => array('update', 'destroy'),
 178                         'users' => array()
 179                 );
 180
 181                 if (array_key_exists($apiaction, $write_methods)) {
 182                         if (!in_array($cmdtext, $write_methods[$apiaction])) {
 183                                 return true;
 184                         }
 185                 }
 186
 187                 return false;
 188         }
 189
 190 }