Skip to content

Commit 213ad80

Browse files
fuzegitfuzegit
committed
флаг, требующий авторизации при запросе метода,
дополнения к методам: auth.confirm, auth.login, auth.restore, auth.signup добавлены методы: auth.reset, users.email.exists, users.get_sig, users.update_password, users.update_password_fields, widgets.get_pages, widgets.get_widgets + мелкие исправления/изменения
1 parent e88a085 commit 213ad80

File tree

15 files changed

+621
-42
lines changed

15 files changed

+621
-42
lines changed

‎package/system/controllers/api/actions/method.php‎

100644100755
Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,13 +152,38 @@ public function run($method_name = null){
152152
);
153153
}
154154

155+
// если передан ip адрес, считаем его адресом посетителя
156+
// для различных проверок компонентов
157+
// т.к. движок определяет ip адрес места запроса
158+
if($this->request->has('ip')){
159+
160+
$ip = $this->request->get('ip', '');
161+
162+
if (!$ip || filter_var($ip, FILTER_VALIDATE_IP) !== $ip) {
163+
return $this->error(777);
164+
}
165+
166+
cmsUser::setIp($ip);
167+
168+
}
169+
155170
// проверяем sig, если включена проверка
156171
if(!empty($this->method_action->check_sig)){
157172
if(!check_sig($this->request->get('sig', ''))){
158173
return $this->error(115);
159174
}
160175
}
161176

177+
// проверяем авторизацию, если метод её требует
178+
if(!empty($this->method_action->auth_required)){
179+
if(!$this->cms_user->is_logged){
180+
return $this->error(71);
181+
}
182+
}
183+
184+
// ставим ключ API в свойство
185+
$this->method_action->key = $this->key;
186+
162187
// валидация параметров запроса
163188
$params_error = $this->validateMethodParams();
164189
if($params_error !== false){

‎package/system/controllers/api/api_actions/api_auth_confirm.php‎

100644100755
Lines changed: 44 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,6 @@ class actionAuthApiAuthConfirm extends cmsAction {
1414
* @var array
1515
*/
1616
public $result;
17-
/**
18-
* Флаг, обязующий проверять параметр sig запроса
19-
* sig привязан к домену сайта и к ip адресу посетителя
20-
* @var boolean
21-
*/
22-
public $check_sig = true;
2317

2418
/**
2519
* Возможные параметры запроса
@@ -30,21 +24,15 @@ class actionAuthApiAuthConfirm extends cmsAction {
3024
*/
3125
public $request_params = array(
3226
'code' => array(
27+
'default' => '',
3328
'rules' => array(
3429
array('required'),
3530
array('regexp', '/^[0-9a-f]{32}$/i')
3631
)
37-
),
38-
'user_id' => array(
39-
'default' => 0,
40-
'rules' => array(
41-
array('required'),
42-
array('digits')
43-
)
4432
)
4533
);
4634

47-
private $users_model, $user;
35+
private $user;
4836

4937
public function validateApiRequest() {
5038

@@ -61,10 +49,8 @@ public function validateApiRequest() {
6149

6250
}
6351

64-
$this->users_model = cmsCore::getModel('users');
65-
66-
$this->user = $this->users_model->getUserByPassToken($this->request->get('code'));
67-
if (!$this->user || $this->user['id'] != $this->request->get('user_id')) {
52+
$this->user = $this->model_users->getUserByPassToken($this->request->get('code', ''));
53+
if (!$this->user) {
6854
return array('error_code' => 1110);
6955
}
7056

@@ -74,12 +60,50 @@ public function validateApiRequest() {
7460

7561
public function run(){
7662

77-
$this->users_model->unlockUser($this->user['id']);
78-
$this->users_model->clearUserPassToken($this->user['id']);
63+
$this->model_users->unlockUser($this->user['id']);
64+
$this->model_users->clearUserPassToken($this->user['id']);
7965

8066
cmsEventsManager::hook('user_registered', $this->user);
8167

68+
$auth_user = array();
69+
70+
if ($this->options['reg_auto_auth']){
71+
72+
$this->user = $this->model_users->getUser($this->user['id']);
73+
74+
$this->user['avatar'] = cmsModel::yamlToArray($this->user['avatar']);
75+
if ($this->user['avatar']){
76+
foreach($this->user['avatar'] as $size => $path){
77+
$this->user['avatar'][$size] = $this->cms_config->upload_host_abs.'/'.$path;
78+
}
79+
}
80+
81+
$this->user = cmsEventsManager::hook('user_login', $this->user);
82+
83+
cmsUser::setUserSession($this->user);
84+
85+
$update_data = array(
86+
'ip' => cmsUser::getIp()
87+
);
88+
89+
$this->model->update('{users}', $this->user['id'], $update_data, true);
90+
91+
cmsEventsManager::hook('auth_login', $this->user['id']);
92+
93+
unset($this->user['password'], $this->user['password_salt'], $this->user['pass_token'], $this->user['date_token'], $this->user['ip'], $this->user['is_admin']);
94+
95+
$auth_user = array(
96+
'session_name' => session_name(),
97+
'session_id' => session_id(),
98+
'expires_in' => ini_get('session.gc_maxlifetime'),
99+
'user_id' => $this->user['id'],
100+
'user_info' => $this->user
101+
);
102+
103+
}
104+
82105
$this->result = array(
106+
'auth_user' => $auth_user,
83107
'success' => true,
84108
'success_text' => LANG_REG_SUCCESS_VERIFIED
85109
);

‎package/system/controllers/api/api_actions/api_auth_login.php‎

100644100755
Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ class actionAuthApiAuthLogin extends cmsAction {
5252
'user_info' => array( // название ключа в $this->result
5353
'type' => 'item', // list или item
5454
'unsets' => array( // массив названий ключей для удаления
55-
'password', 'password_salt', 'pass_token', 'date_token'
55+
'password', 'password_salt', 'pass_token', 'date_token', 'ip', 'is_admin'
5656
)
5757
)
5858
);
@@ -61,15 +61,25 @@ class actionAuthApiAuthLogin extends cmsAction {
6161

6262
public function validateApiRequest() {
6363

64-
$logged_id = cmsUser::login($this->request->get('email', ''), $this->request->get('password', ''), true);
64+
// если авторизован, проверки не выполняем
65+
if($this->cms_user->is_logged){
66+
67+
$this->user = $this->model_users->getUser($this->cms_user->id);
68+
69+
return false;
70+
71+
}
72+
73+
74+
$logged_id = cmsUser::login($this->request->get('email', ''), $this->request->get('password', ''));
6575

6676
if(!$logged_id){
6777
return array(
6878
'error_code' => 5
6979
);
7080
}
7181

72-
$this->user = cmsCore::getModel('users')->getUser($logged_id);
82+
$this->user = $this->model_users->getUser($logged_id);
7383

7484
if ($this->user['is_admin']) {
7585

@@ -99,6 +109,7 @@ public function run(){
99109
$this->result = array(
100110
'session_name' => session_name(),
101111
'session_id' => session_id(),
112+
'expires_in' => ini_get('session.gc_maxlifetime'),
102113
'user_id' => $this->user['id'],
103114
'user_info' => $this->user
104115
);

‎package/system/controllers/api/api_actions/api_auth_reset.php‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
<?php
2+
3+
class actionAuthApiAuthReset extends cmsAction {
4+
5+
/**
6+
* Блокировка прямого вызова экшена
7+
* обязательное свойство
8+
* @var boolean
9+
*/
10+
public $lock_explicit_call = true;
11+
/**
12+
* Результат запроса
13+
* обязательное свойство
14+
* @var array
15+
*/
16+
public $result;
17+
18+
/**
19+
* Флаг, обязующий проверять параметр sig запроса
20+
* sig привязан к домену сайта и к ip адресу посетителя
21+
* @var boolean
22+
*/
23+
public $check_sig = true;
24+
25+
/**
26+
* Возможные параметры запроса
27+
* с правилами валидации
28+
* Если запрос имеет параметры, необходимо описать их здесь
29+
* Правила валидации параметров задаются по аналогии с полями форм
30+
* @var array
31+
*/
32+
public $request_params = array(
33+
'code' => array(
34+
'default' => '',
35+
'rules' => array(
36+
array('required'),
37+
array('regexp', '/^[0-9a-f]{32}$/i')
38+
)
39+
),
40+
'password1' => array(
41+
'default' => '',
42+
'rules' => array(
43+
array('required'),
44+
array('min_length', 6)
45+
)
46+
),
47+
'password2' => array(
48+
'default' => '',
49+
'rules' => array(
50+
array('required'),
51+
array('min_length', 6)
52+
)
53+
),
54+
);
55+
56+
private $user;
57+
58+
public function validateApiRequest() {
59+
60+
$pass_token = $this->request->get('code', '');
61+
62+
$this->user = $this->model_users->getUserByPassToken($pass_token);
63+
64+
if (!$this->user) {
65+
return array('error_code' => 113);
66+
}
67+
68+
if ($this->user['is_admin']) {
69+
return array('error_code' => 15);
70+
}
71+
72+
if($this->user['is_locked']) {
73+
74+
return array('request_params' => array(
75+
'code' => LANG_RESTORE_BLOCK.($this->user['lock_reason'] ? '. '.$this->user['lock_reason'] : '')
76+
));
77+
78+
}
79+
80+
if ((strtotime($this->user['date_token']) + 3600) < time()){
81+
82+
$this->model_users->clearUserPassToken($this->user['id']);
83+
84+
return array('request_params' => array(
85+
'code' => LANG_RESTORE_TOKEN_EXPIRED
86+
));
87+
88+
}
89+
90+
if($this->request->get('password1', '') !== $this->request->get('password2', '')) {
91+
92+
return array('request_params' => array(
93+
'password1' => LANG_REG_PASS_NOT_EQUAL,
94+
'password2' => LANG_REG_PASS_NOT_EQUAL
95+
));
96+
97+
}
98+
99+
return false;
100+
101+
}
102+
103+
public function run(){
104+
105+
$this->model_users->updateUser($this->user['id'], array(
106+
'password1' => $this->request->get('password1', ''),
107+
'password2' => $this->request->get('password2', '')
108+
));
109+
110+
$this->model_users->clearUserPassToken($this->user['id']);
111+
112+
$this->result = array(
113+
'user_id' => $this->user['id'],
114+
'success' => true,
115+
'success_text' => LANG_PASS_CHANGED
116+
);
117+
118+
}
119+
120+
}

‎package/system/controllers/api/api_actions/api_auth_restore.php‎

100644100755
Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,6 @@ class actionAuthApiAuthRestore extends cmsAction {
1414
* @var array
1515
*/
1616
public $result;
17-
/**
18-
* Флаг, обязующий проверять параметр sig запроса
19-
* sig привязан к домену сайта и к ip адресу посетителя
20-
* @var boolean
21-
*/
22-
public $check_sig = true;
2317

2418
/**
2519
* Возможные параметры запроса
@@ -38,15 +32,13 @@ class actionAuthApiAuthRestore extends cmsAction {
3832
),
3933
);
4034

41-
private $users_model, $user;
35+
private $user;
4236

4337
public function validateApiRequest() {
4438

4539
$email = $this->request->get('email', '');
4640

47-
$this->users_model = cmsCore::getModel('users');
48-
49-
$this->user = $this->users_model->getUserByEmail($email);
41+
$this->user = $this->model_users->getUserByEmail($email);
5042

5143
if (!$this->user) {
5244
return array('error_code' => 113);
@@ -78,7 +70,7 @@ public function run(){
7870

7971
$pass_token = string_random(32, $this->user['email']);
8072

81-
$this->users_model->updateUserPassToken($this->user['id'], $pass_token);
73+
$this->model_users->updateUserPassToken($this->user['id'], $pass_token);
8274

8375
$messenger = cmsCore::getController('messages');
8476

@@ -88,6 +80,7 @@ public function run(){
8880
$messenger->sendEmail($to, $letter, array(
8981
'nickname' => $this->user['nickname'],
9082
'page_url' => href_to_abs('auth', 'reset', $pass_token),
83+
'pass_token' => $pass_token,
9184
'valid_until' => html_date(date('d.m.Y H:i', time() + (24 * 3600)), true),
9285
));
9386

0 commit comments

Comments
 (0)