sydney/IPB
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 4.5.0

Browse Source
This commit is contained in:
Neo committed 2025-12-19 05:51:58 -08:00
1 parent 1a0c7fd3c2
commit f79dcf067a
3791 files changed
+248032 -76372
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

system/Dispatcher/Api.php
+19 -68
View File
@@ -11,7 +11,7 @@
namespace IPS\Dispatcher;
/* To prevent PHP errors (extending class does not exist) revealing path */
if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
{
header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
exit;
@@ -78,6 +78,10 @@ class _Api extends \IPS\Dispatcher
if ( $this->rawAccessToken )
{
$this->_setAccessToken();
if ( !$this->accessToken['scope'] or !json_decode( $this->accessToken['scope'] ) )
{
throw new \IPS\Api\Exception( 'NO_SCOPES', '3S290/B', 401, 'insufficient_scope' );
}
}
elseif ( $this->rawApiKey )
{
@@ -97,9 +101,9 @@ class _Api extends \IPS\Dispatcher
$response = json_encode( array( 'errorCode' => $e->exceptionCode, 'errorMessage' => $e->getMessage() ), JSON_PRETTY_PRINT );
/* Do we need to log this? */
if ( $this->rawApiKey !== 'test' and in_array( $e->exceptionCode, array( '2S290/8', '2S290/B', '3S290/7', '3S290/9' ) ) )
if ( $this->rawApiKey !== 'test' and \in_array( $e->exceptionCode, array( '2S290/8', '2S290/B', '3S290/7', '3S290/9' ) ) )
{
$this->_log( $response, $e->getCode(), in_array( $e->exceptionCode, array( '3S290/7', '3S290/9', '3S290/B' ) ) );
$this->_log( $response, $e->getCode(), \in_array( $e->exceptionCode, array( '3S290/7', '3S290/9', '3S290/B' ) ) );
}
/* Output */
@@ -154,48 +158,7 @@ class _Api extends \IPS\Dispatcher
*/
public function _setRawCredentials()
{
/* Check if an API Key or Access Token has been passed as a parameter in the query string. Because of the
obvious security issues with this, we do not recommend it, but sometimes it is the only choice */
if ( isset( \IPS\Request::i()->key ) )
{
$this->rawApiKey = \IPS\Request::i()->key;
return;
}
if ( isset( \IPS\Request::i()->access_token ) and ( !\IPS\OAUTH_REQUIRES_HTTPS or \IPS\Request::i()->isSecure() ) )
{
$this->rawAccessToken = \IPS\Request::i()->access_token;
return;
}
/* Look for an API key in an automatically decoded HTTP Basic header */
if ( isset( $_SERVER['PHP_AUTH_USER'] ) )
{
$this->rawApiKey = $_SERVER['PHP_AUTH_USER'];
return;
}
/* If we're still here, try to find an Authorization header - start with $_SERVER... */
$authorizationHeader = NULL;
foreach ( $_SERVER as $k => $v )
{
if ( mb_substr( $k, -18 ) == 'HTTP_AUTHORIZATION' )
{
$authorizationHeader = $v;
}
}
/* ...if we didn't find anything there, try apache_request_headers() */
if ( !$authorizationHeader and function_exists('apache_request_headers') )
{
$headers = @apache_request_headers();
if ( isset( $headers['Authorization'] ) )
{
$authorizationHeader = $headers['Authorization'];
}
}
/* If we managed to get one, set if it's an API Key or an Access Token */
if ( $authorizationHeader )
if ( $authorizationHeader = \IPS\Request::i()->authorizationHeader() )
{
if ( mb_substr( $authorizationHeader, 0, 7 ) === 'Bearer ' and ( !\IPS\OAUTH_REQUIRES_HTTPS or \IPS\Request::i()->isSecure() ) )
{
@@ -263,7 +226,7 @@ class _Api extends \IPS\Dispatcher
{
$this->apiKey = \IPS\Api\Key::load( $this->rawApiKey );
if ( $this->apiKey->allowed_ips and !in_array( \IPS\Request::i()->ipAddress(), explode( ',', $this->apiKey->allowed_ips ) ) )
if ( $this->apiKey->allowed_ips and !\in_array( \IPS\Request::i()->ipAddress(), explode( ',', $this->apiKey->allowed_ips ) ) )
{
throw new \IPS\Api\Exception( 'IP_ADDRESS_NOT_ALLOWED', '2S290/8', 403 );
}
@@ -283,22 +246,7 @@ class _Api extends \IPS\Dispatcher
{
try
{
$exploded = explode( '_', $this->rawAccessToken );
if ( !isset( $exploded[0] ) or !isset( $exploded[1] ) )
{
throw new \UnderflowException;
}
$this->accessToken = \IPS\Db::i()->select( '*', 'core_oauth_server_access_tokens', array( 'client_id=? AND access_token=?', $exploded[0], $exploded[1] ) )->first();
if ( $this->accessToken['access_token_expires'] and $this->accessToken['access_token_expires'] < time() )
{
throw new \IPS\Api\Exception( 'EXPIRED_ACCESS_TOKEN', '1S290/E', 401, 'invalid_token' );
}
if ( !$this->accessToken['scope'] or !json_decode( $this->accessToken['scope'] ) )
{
throw new \IPS\Api\Exception( 'NO_SCOPES', '3S290/B', 401, 'insufficient_scope' );
}
$this->accessToken = \IPS\Api\OAuthClient::accessTokenDetails( $this->rawAccessToken );
}
catch ( \UnderflowException $e )
{
@@ -317,7 +265,7 @@ class _Api extends \IPS\Dispatcher
{
if ( isset( $_SERVER['HTTP_X_IPS_LANGUAGE'] ) )
{
$this->language = \IPS\Lang::load( intval( $_SERVER['HTTP_X_IPS_LANGUAGE'] ) );
$this->language = \IPS\Lang::load( \intval( $_SERVER['HTTP_X_IPS_LANGUAGE'] ) );
}
else
{
@@ -381,9 +329,10 @@ class _Api extends \IPS\Dispatcher
$response = $controller->execute( $pathBits, $shouldLog );
/* Send Output */
$output = json_encode( $response->getOutput(), JSON_PRETTY_PRINT );
$output = $response->getOutput();
$this->language->parseOutputForDisplay( $output );
$this->_respond( $output, $response->httpCode, NULL, $shouldLog, TRUE );
$this->_respond( json_encode( $output, JSON_PRETTY_PRINT ), $response->httpCode, NULL, $shouldLog, TRUE );
}
catch ( \IPS\Api\Exception $e )
{
@@ -430,9 +379,11 @@ class _Api extends \IPS\Dispatcher
/**
* Output response
*
* @param string $response Response to output
* @param int $httpResponseCode HTTP Response Code
* @param bool $parseLanguage If response should be language parsed
* @param string $response Response to output
* @param int $httpResponseCode HTTP Response Code
* @param NULL|string $oauthError OAuth error
* @param bool $log Whether or not to log the response
* @return void
*/
protected function _respond( $response, $httpResponseCode, $oauthError=NULL, $log=FALSE )
{