580 lines
17 KiB
PHP
580 lines
17 KiB
PHP
<?php
|
|
|
|
/*
|
|
+--------------------------------------------------------------------------
|
|
| Invision Power Board
|
|
| =============================================
|
|
| by Matthew Mecham
|
|
| (c) 2001 - 2007 Invision Power Services, Inc.
|
|
| http://www.invisionpower.com
|
|
| =============================================
|
|
| Web: http://www.invisionboard.com
|
|
| Licence Info: http://www.invisionboard.com/?license
|
|
+---------------------------------------------------------------------------
|
|
| > $Date: 2006-09-22 11:28:54 +0100 (Fri, 22 Sep 2006) $
|
|
| > $Revision: 567 $
|
|
| > $Author: matt $
|
|
+---------------------------------------------------------------------------
|
|
|
|
|
| > API User Administration
|
|
| > Module written by Matt Mecham
|
|
| > Date started: Monday 25 June 2007
|
|
|
|
|
| > Module Version Number: 1.0.0
|
|
+--------------------------------------------------------------------------
|
|
*/
|
|
|
|
|
|
if ( ! defined( 'IN_ACP' ) )
|
|
{
|
|
print "<h1>Incorrect access</h1>You cannot access this file directly. If you have recently upgraded, make sure you upgraded 'admin.php'.";
|
|
exit();
|
|
}
|
|
|
|
class ad_api
|
|
{
|
|
/*-------------------------------------------------------------------------*/
|
|
// Auto run
|
|
/*-------------------------------------------------------------------------*/
|
|
|
|
function auto_run()
|
|
{
|
|
//-----------------------------------------
|
|
// Make sure we're a root admin, or else!
|
|
//-----------------------------------------
|
|
|
|
if ($this->ipsclass->member['mgroup'] != $this->ipsclass->vars['admin_group'])
|
|
{
|
|
$this->ipsclass->admin->error("Sorry, these functions are for the root admin group only");
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Load skin...
|
|
//-----------------------------------------
|
|
|
|
$this->html = $this->ipsclass->acp_load_template('cp_skin_api');
|
|
|
|
$this->ipsclass->admin->nav[] = array( $this->ipsclass->form_code, 'XML-RPC API Management' );
|
|
|
|
//-----------------------------------------
|
|
// What are we to do, today?
|
|
//-----------------------------------------
|
|
|
|
switch( $this->ipsclass->input['code'] )
|
|
{
|
|
//-----------------------------------------
|
|
// Default:
|
|
//-----------------------------------------
|
|
case 'api_list':
|
|
default:
|
|
$this->api_list();
|
|
break;
|
|
case 'api_add':
|
|
$this->api_form( 'add' );
|
|
break;
|
|
case 'api_add_save':
|
|
$this->api_save( 'add' );
|
|
break;
|
|
case 'api_edit':
|
|
$this->api_form( 'edit' );
|
|
break;
|
|
case 'api_edit_save':
|
|
$this->api_save( 'edit' );
|
|
break;
|
|
case 'api_remove':
|
|
$this->api_remove();
|
|
break;
|
|
|
|
case 'log_list':
|
|
$this->log_list();
|
|
break;
|
|
case 'log_view_detail':
|
|
$this->log_view_detail();
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*-------------------------------------------------------------------------*/
|
|
// API Logs View
|
|
/*-------------------------------------------------------------------------*/
|
|
/**
|
|
* API Logs View
|
|
* View API Log
|
|
*
|
|
* @author Matt Mecham
|
|
* @since 2.3.2
|
|
*/
|
|
/*
|
|
CREATE TABLE ibf_api_log (
|
|
api_log_id int(10) unsigned NOT NULL auto_increment,
|
|
api_log_key VARCHAR(32) NOT NULL,
|
|
api_log_ip VARCHAR(16) NOT NULL,
|
|
api_log_date INT(10) NOT NULL,
|
|
api_log_query TEXT NOT NULL,
|
|
api_log_allowed TINYINT(1) unsigned NOT NULL,
|
|
PRIMARY KEY (api_log_id)
|
|
);*/
|
|
|
|
function log_view_detail()
|
|
{
|
|
//-----------------------------------------
|
|
// INIT
|
|
//-----------------------------------------
|
|
|
|
$api_log_id = intval( $this->ipsclass->input['api_log_id'] );
|
|
|
|
//-----------------------------------------
|
|
// Get data from the deebee
|
|
//-----------------------------------------
|
|
|
|
$log = $this->ipsclass->DB->build_and_exec_query( array( 'select' => '*',
|
|
'from' => 'api_log',
|
|
'where' => 'api_log_id='.$api_log_id ) );
|
|
|
|
if ( ! $log['api_log_id'] )
|
|
{
|
|
$this->ipsclass->main_msg = "No log for that ID found";
|
|
$this->log_list();
|
|
return;
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Display...
|
|
//-----------------------------------------
|
|
|
|
$log['_api_log_date'] = $this->ipsclass->get_date( $log['api_log_date'], 'LONG' );
|
|
$log['_api_log_allowed'] = $log['api_log_allowed'] ? 'aff_tick.png' : 'aff_cross.png';
|
|
$log['_api_log_query'] = htmlspecialchars( $log['api_log_query'] );
|
|
|
|
//-----------------------------------------
|
|
// Show...
|
|
//-----------------------------------------
|
|
|
|
$this->ipsclass->html .= $this->html->api_log_detail( $log );
|
|
|
|
$this->ipsclass->admin->print_popup();
|
|
}
|
|
|
|
/*-------------------------------------------------------------------------*/
|
|
// API Logs List
|
|
/*-------------------------------------------------------------------------*/
|
|
/**
|
|
* API Logs List
|
|
* List API Logs
|
|
*
|
|
* @author Matt Mecham
|
|
* @since 2.3.2
|
|
*/
|
|
function log_list()
|
|
{
|
|
//-----------------------------------------
|
|
// INIT
|
|
//-----------------------------------------
|
|
|
|
$start = intval( $this->ipsclass->input['st'] );
|
|
$perpage = 50;
|
|
$logs = array();
|
|
|
|
//-----------------------------------------
|
|
// Get log count
|
|
//-----------------------------------------
|
|
|
|
$count = $this->ipsclass->DB->build_and_exec_query( array( 'select' => 'count(*) as count',
|
|
'from' => 'api_log' ) );
|
|
|
|
$links = $this->ipsclass->adskin->build_pagelinks( array( 'TOTAL_POSS' => intval( $count['count'] ),
|
|
'PER_PAGE' => $perpage,
|
|
'CUR_ST_VAL' => $start,
|
|
'L_SINGLE' => "",
|
|
'L_MULTI' => "Pages: ",
|
|
'BASE_URL' => $this->ipsclass->base_url.'&'.$this->ipsclass->form_code ) );
|
|
|
|
//-----------------------------------------
|
|
// Get from DB
|
|
//-----------------------------------------
|
|
|
|
$this->ipsclass->DB->build_query( array( 'select' => '*',
|
|
'from' => 'api_log',
|
|
'order' => 'api_log_date DESC',
|
|
'limit' => array( $start, $perpage ) ) );
|
|
|
|
$this->ipsclass->DB->exec_query();
|
|
|
|
while( $row = $this->ipsclass->DB->fetch_row() )
|
|
{
|
|
$row['_api_log_date'] = $this->ipsclass->admin->get_date( $row['api_log_date'] );
|
|
$row['_api_log_allowed'] = $row['api_log_allowed'] ? 'aff_tick.png' : 'aff_cross.png';
|
|
|
|
$logs[] = $row;
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Print...
|
|
//-----------------------------------------
|
|
|
|
$this->ipsclass->html .= $this->ipsclass->skin_acp_global->information_box( "XML-RPC API Logs", "This page shows all the recorded XML-RPC requests.<br />The red cross indicates an error during the request and a green tick indicates a successful request." ) . "<br />";
|
|
|
|
$this->ipsclass->html .= $this->html->api_login_view( $logs, $links );
|
|
|
|
$this->ipsclass->admin->output();
|
|
}
|
|
|
|
/*-------------------------------------------------------------------------*/
|
|
// API User Remove
|
|
/*-------------------------------------------------------------------------*/
|
|
/**
|
|
* API User Remove
|
|
* Removes an API User
|
|
*
|
|
* @author Brandon Farber
|
|
* @since 2.3.2
|
|
*/
|
|
function api_remove()
|
|
{
|
|
$api_user_id = isset($this->ipsclass->input['api_user_id']) ? intval($this->ipsclass->input['api_user_id']) : 0;
|
|
|
|
if( !$api_user_id )
|
|
{
|
|
$this->ipsclass->main_msg = "Could not determine the user to remove";
|
|
$this->api_list();
|
|
return;
|
|
}
|
|
|
|
$api_user = $this->ipsclass->DB->build_and_exec_query( array( 'select' => '*',
|
|
'from' => 'api_users',
|
|
'where' => 'api_user_id='.$api_user_id ) );
|
|
|
|
if ( ! $api_user['api_user_id'] )
|
|
{
|
|
$this->ipsclass->main_msg = "The API user could not be found.";
|
|
$this->api_list();
|
|
return;
|
|
}
|
|
|
|
$this->ipsclass->DB->do_delete( 'api_users', 'api_user_id='.$api_user_id );
|
|
|
|
$this->ipsclass->main_msg = "API User successfully removed";
|
|
$this->api_list();
|
|
}
|
|
|
|
/*-------------------------------------------------------------------------*/
|
|
// API Form
|
|
/*-------------------------------------------------------------------------*/
|
|
/**
|
|
* API Save
|
|
* Save API user
|
|
*
|
|
* @author Matt Mecham
|
|
* @since 2.3.2
|
|
*/
|
|
function api_save( $type='add' )
|
|
{
|
|
//-----------------------------------------
|
|
// INIT
|
|
//-----------------------------------------
|
|
|
|
$api_user_id = isset($this->ipsclass->input['api_user_id']) ? intval($this->ipsclass->input['api_user_id']) : 0;
|
|
$api_user_key = $this->ipsclass->input['api_user_key'];
|
|
$api_user_name = $this->ipsclass->input['api_user_name'];
|
|
$api_user_ip = $this->ipsclass->input['api_user_ip'];
|
|
$permissions = array();
|
|
|
|
//-----------------------------------------
|
|
// Check (please?)
|
|
//-----------------------------------------
|
|
|
|
if ( ! $api_user_name )
|
|
{
|
|
$this->ipsclass->main_msg = "You must enter a title";
|
|
$this->api_form( $type );
|
|
return;
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// More checking...
|
|
//-----------------------------------------
|
|
|
|
if ( $type == 'add' )
|
|
{
|
|
if ( ! $api_user_key )
|
|
{
|
|
$this->ipsclass->main_msg = "No API user key was passed!";
|
|
$this->api_form( $type );
|
|
return;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
$api_user = $this->ipsclass->DB->build_and_exec_query( array( 'select' => '*',
|
|
'from' => 'api_users',
|
|
'where' => 'api_user_id='.$api_user_id ) );
|
|
|
|
if ( ! $api_user['api_user_id'] )
|
|
{
|
|
$this->ipsclass->main_msg = "The API user could not be found.";
|
|
$this->api_list();
|
|
return;
|
|
}
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Save basics
|
|
//-----------------------------------------
|
|
|
|
$save = array( 'api_user_name' => $api_user_name,
|
|
'api_user_ip' => $api_user_ip );
|
|
|
|
//-----------------------------------------
|
|
// Sort out permissions...
|
|
//-----------------------------------------
|
|
|
|
foreach( $this->ipsclass->input as $key => $value )
|
|
{
|
|
if ( preg_match( "#^_perm_([^_]+?)_(.*)$#", $key, $matches ) )
|
|
{
|
|
$module = $matches[1];
|
|
$function = $matches[2];
|
|
|
|
if ( $value )
|
|
{
|
|
$permissions[ $module ][ $function ] = 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Add in perms
|
|
//-----------------------------------------
|
|
|
|
$save['api_user_perms'] = serialize( $permissions );
|
|
|
|
//-----------------------------------------
|
|
// Save...
|
|
//-----------------------------------------
|
|
|
|
if ( $type == 'add' )
|
|
{
|
|
//-----------------------------------------
|
|
// Add in key..
|
|
//-----------------------------------------
|
|
|
|
$save['api_user_key'] = $api_user_key;
|
|
|
|
//-----------------------------------------
|
|
// Save it...
|
|
//-----------------------------------------
|
|
|
|
$this->ipsclass->main_msg = "API User Added";
|
|
|
|
$this->ipsclass->DB->do_insert( 'api_users', $save );
|
|
}
|
|
else
|
|
{
|
|
$this->ipsclass->main_msg = "API User Edit";
|
|
|
|
$this->ipsclass->DB->do_update( 'api_users', $save, 'api_user_id=' . $api_user_id );
|
|
}
|
|
|
|
$this->api_list();
|
|
}
|
|
|
|
/*-------------------------------------------------------------------------*/
|
|
// API Form
|
|
/*-------------------------------------------------------------------------*/
|
|
/**
|
|
* API LIST
|
|
* List all currently stored API users
|
|
*
|
|
* @author Matt Mecham
|
|
* @since 2.3.2
|
|
*/
|
|
function api_form( $type='add' )
|
|
{
|
|
//-----------------------------------------
|
|
// INIT
|
|
//-----------------------------------------
|
|
|
|
$api_user_id = isset($this->ipsclass->input['api_user_id']) ? intval($this->ipsclass->input['api_user_id']) : 0;
|
|
$form = array();
|
|
$permissions = array();
|
|
|
|
//-----------------------------------------
|
|
// Check (please?)
|
|
//-----------------------------------------
|
|
|
|
if ( $type == 'add' )
|
|
{
|
|
$formcode = 'api_add_save';
|
|
$title = "Create New API User";
|
|
$button = "Create New API User";
|
|
$api_user = array();
|
|
$api_perms = array();
|
|
}
|
|
else
|
|
{
|
|
$api_user = $this->ipsclass->DB->build_and_exec_query( array( 'select' => '*',
|
|
'from' => 'api_users',
|
|
'where' => 'api_user_id='.$api_user_id ) );
|
|
|
|
if ( ! $api_user['api_user_id'] )
|
|
{
|
|
$this->ipsclass->main_msg = "The API user could not be found.";
|
|
$this->api_list();
|
|
return;
|
|
}
|
|
|
|
$formcode = 'api_edit_save';
|
|
$title = "Edit API User: ".$api_user['api_user_name'];
|
|
$button = "Save Changes";
|
|
|
|
$api_perms = unserialize( $api_user['api_user_perms'] );
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Form
|
|
//-----------------------------------------
|
|
|
|
$form['api_user_name'] = $this->ipsclass->adskin->form_input( 'api_user_name', ( isset($_POST['api_user_name']) AND $_POST['api_user_name'] ) ? stripslashes($_POST['api_user_name']) : $api_user['api_user_name'] );
|
|
$form['api_user_ip'] = $this->ipsclass->adskin->form_input( 'api_user_ip', ( isset($_POST['api_user_ip']) AND $_POST['api_user_ip'] ) ? stripslashes($_POST['api_user_ip']) : $api_user['api_user_ip'] );
|
|
|
|
//-----------------------------------------
|
|
// Get all modules and stuff and other things
|
|
//-----------------------------------------
|
|
|
|
$path = ROOT_PATH . 'interface/board/modules';
|
|
|
|
if ( is_dir( $path ) )
|
|
{
|
|
$handle = opendir( $path );
|
|
|
|
while ( ( $file = readdir($handle) ) !== FALSE )
|
|
{
|
|
if ( is_dir( $path . '/' . $file ) )
|
|
{
|
|
if ( file_exists( $path . '/' . $file . '/config.php' ) )
|
|
{
|
|
$_name = $file;
|
|
|
|
require_once( $path . "/" . $file . '/config.php' );
|
|
|
|
if ( $CONFIG['api_module_title'] )
|
|
{
|
|
$permissions[ $_name ] = array( 'key' => $api_module_title,
|
|
'title' => $CONFIG['api_module_title'],
|
|
'desc' => $CONFIG['api_module_desc'],
|
|
'path' => $path . "/" . $file,
|
|
'perms' => array() );
|
|
|
|
//-----------------------------------------
|
|
// Get all available methods
|
|
//-----------------------------------------
|
|
|
|
if ( file_exists( $path . '/' . $file . '/methods.php' ) )
|
|
{
|
|
require_once( $path . '/' . $file . '/methods.php' );
|
|
|
|
$permissions[ $_name ]['perms'] = array_keys( $ALLOWED_METHODS );
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Sort out form field
|
|
//-----------------------------------------
|
|
|
|
if ( is_array( $permissions[ $_name ]['perms'] ) )
|
|
{
|
|
foreach( $permissions[ $_name ]['perms'] as $perm )
|
|
{
|
|
$_checked = intval( $api_perms[ $_name ][ $perm ] );
|
|
$permissions[ $_name ]['form_perms'][ $perm ] = array( 'title' => $perm,
|
|
'form' => $this->ipsclass->adskin->form_checkbox( '_perm_' . $_name . '_' . $perm, $_checked, 1 ) );
|
|
}
|
|
}
|
|
}
|
|
|
|
$CONFIG = array();
|
|
$ALLOWED_METHODS = array();
|
|
}
|
|
}
|
|
}
|
|
|
|
closedir( $handle );
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Auto-generate API key
|
|
//-----------------------------------------
|
|
|
|
if ( $type == 'add' )
|
|
{
|
|
$form['_api_user_key'] = md5( rand( 0, time() ) . $this->ipsclass->member['member_login_key'] . microtime() );
|
|
}
|
|
|
|
$this->ipsclass->html .= $this->ipsclass->skin_acp_global->information_box( "XML-RPC User Management", "You may create API users for use with the XML-RPC system which allows other applications to access IP.Board data" ) . "<br />";
|
|
$this->ipsclass->html .= $this->html->api_form( $form, $title, $formcode, $button, $api_user, $type, $permissions );
|
|
|
|
$this->ipsclass->admin->nav[] = array( "", "Add/Edit API User" );
|
|
$this->ipsclass->admin->output();
|
|
}
|
|
|
|
/*-------------------------------------------------------------------------*/
|
|
// API List
|
|
/*-------------------------------------------------------------------------*/
|
|
/**
|
|
* API LIST
|
|
* List all currently stored API users
|
|
*
|
|
* @author Matt Mecham
|
|
* @since 2.3.2
|
|
*/
|
|
function api_list()
|
|
{
|
|
//-----------------------------------------
|
|
// INIT
|
|
//-----------------------------------------
|
|
|
|
$users = array();
|
|
|
|
//-----------------------------------------
|
|
// Get users from the DB
|
|
//-----------------------------------------
|
|
|
|
$this->ipsclass->DB->build_query( array( 'select' => '*',
|
|
'from' => 'api_users',
|
|
'order' => 'api_user_id' ) );
|
|
|
|
$this->ipsclass->DB->exec_query();
|
|
|
|
while( $row = $this->ipsclass->DB->fetch_row() )
|
|
{
|
|
$users[] = $row;
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// XML RPC Enabled?
|
|
//-----------------------------------------
|
|
|
|
if ( ! $this->ipsclass->vars['xmlrpc_enable'] )
|
|
{
|
|
$this->ipsclass->html .= $this->ipsclass->skin_acp_global->warning_box( "XML-RPC System Disabled", "<strong>The XML-RPC system is not enabled!</strong><br />All API requests will fail. <a href='{$this->ipsclass->base_url}&section=tools&act=op&code=setting_view&conf_title_keyword=xmlrpcapi'>Click here to enable it</a>" ) . "<br >";
|
|
}
|
|
else
|
|
{
|
|
$this->ipsclass->html .= $this->ipsclass->skin_acp_global->information_box( "XML-RPC User Management", "You may create API users for use with the XML-RPC system which allows other applications to access IP.Board data" ) . "<br />";
|
|
}
|
|
|
|
//-----------------------------------------
|
|
// Dun...
|
|
//-----------------------------------------
|
|
|
|
$this->ipsclass->html .= $this->html->api_list( $users );
|
|
|
|
//-----------------------------------------
|
|
// PRINT
|
|
//-----------------------------------------
|
|
|
|
$this->ipsclass->admin->output();
|
|
}
|
|
}
|
|
|
|
|
|
?>
|