Skip to content

Commit 3f99a90

Browse files
author
fuze
committed
ограничения в методах для ключей,
новый метод users.add http://docs.instantcms.ru/manual/components/api/methods/users-add + мелкие правки
1 parent e11eacb commit 3f99a90

File tree

13 files changed

+218
-15
lines changed

13 files changed

+218
-15
lines changed

‎install.sql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ CREATE TABLE `{#}api_keys` (
55
`api_key` varchar(32) DEFAULT NULL,
66
`description` varchar(100) DEFAULT NULL,
77
`ip_access` text,
8+
`key_methods` text,
89
PRIMARY KEY (`id`),
910
UNIQUE KEY `api_key` (`api_key`)
1011
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

‎manifest.en.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ image = "icon.png"
66
major = "2"
77
minor = "0"
88
build = "0"
9-
date = "20160101"
9+
date = "20170505"
1010

1111
[depends]
1212
core = "2.5.0"

‎manifest.ru.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ image = "icon.png"
66
major = "2"
77
minor = "0"
88
build = "0"
9-
date = "20160101"
9+
date = "20170505"
1010

1111
[depends]
1212
core = "2.5.0"

‎package/system/controllers/api/actions/method.php‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,28 @@
11
<?php
22
/******************************************************************************/
33
// //
4-
// InstantMedia 2016 //
4+
// InstantMedia 2017 //
55
// http://instantmedia.ru/, support@instantmedia.ru //
66
// written by Fuze //
77
// //
88
/******************************************************************************/
99

1010
class actionApiMethod extends cmsAction {
1111

12-
private $key = null;
13-
1412
private $method_name = null;
1513
private $method_params = array();
1614
private $method_controller_name = null;
1715
private $method_action_name = null;
1816

17+
/**
18+
* Объект контроллера api метода
19+
* @var object
20+
*/
1921
private $method_controller = null;
22+
/**
23+
* Объект класса api метода
24+
* @var object
25+
*/
2026
private $method_action = null;
2127

2228
public function __construct($controller, $params=array()){
@@ -310,6 +316,16 @@ public function checkRequest() {
310316
return $this->error(23);
311317
}
312318

319+
$method_name = str_replace('.', '_', $this->method_name);
320+
321+
$is_view = !$this->key['methods_access']['allow'] || in_array($method_name, $this->key['methods_access']['allow']);
322+
$is_hide = $this->key['methods_access']['disallow'] && in_array($method_name, $this->key['methods_access']['disallow']);
323+
324+
// првоеряем доступ к методу
325+
if (!$is_view || $is_hide) {
326+
return $this->error(24);
327+
}
328+
313329
return true;
314330

315331
}

‎package/system/controllers/api/api_actions/api_content_get.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,8 @@ public function run($ctype_name){
277277
list($this->ctype, $items) = cmsEventsManager::hook("content_{$this->ctype['name']}_before_list", array($this->ctype, $items));
278278
list($this->ctype, $items) = cmsEventsManager::hook('content_api_list', array($this->ctype, $items));
279279

280+
$result_items = array();
281+
280282
if($items){
281283
foreach ($items as $key => $item) {
282284

@@ -306,6 +308,9 @@ public function run($ctype_name){
306308
}
307309

308310
}
311+
312+
$result_items[] = $items[$key];
313+
309314
}
310315
}
311316

@@ -314,7 +319,7 @@ public function run($ctype_name){
314319
}
315320

316321
$this->result['count'] = $total;
317-
$this->result['items'] = $items;
322+
$this->result['items'] = $result_items;
318323
$this->result['additionally'] = array(
319324
'fields' => $fields,
320325
'props' => $props,

‎package/system/controllers/api/api_actions/api_content_get_item.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,13 @@ public function validateApiRequest($ctype_name=null) {
7171
}
7272
}
7373

74+
// Проверяем, что не удалено
75+
if (!empty($this->item['is_deleted'])){
76+
if (!$is_moderator){
77+
return array('error_msg' => LANG_API_ERROR100);
78+
}
79+
}
80+
7481
// Проверяем приватность
7582
if ($this->item['is_private'] == 1){ // доступ только друзьям
7683

‎package/system/controllers/api/api_actions/api_users_add.php‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
<?php
2+
3+
class actionUsersApiUsersAdd extends cmsAction {
4+
5+
public function __construct($controller, $params=array()) {
6+
7+
parent::__construct($controller, $params);
8+
9+
$this->is_submitted = $this->request->has('submit');
10+
11+
if($this->is_submitted){
12+
$this->check_sig = true;
13+
}
14+
15+
}
16+
17+
/**
18+
* Блокировка прямого вызова экшена
19+
* обязательное свойство
20+
* @var boolean
21+
*/
22+
public $lock_explicit_call = true;
23+
/**
24+
* Результат запроса
25+
* обязательное свойство
26+
* @var array
27+
*/
28+
public $result;
29+
/**
30+
* Флаг, обязующий проверять параметр sig запроса
31+
* sig привязан к домену сайта и к ip адресу посетителя
32+
* @var boolean
33+
*/
34+
public $check_sig = false;
35+
36+
/**
37+
* Возможные параметры запроса
38+
* с правилами валидации
39+
* Если запрос имеет параметры, необходимо описать их здесь
40+
* Правила валидации параметров задаются по аналогии с полями форм
41+
* @var array
42+
*/
43+
public $request_params = array();
44+
45+
private $is_submitted = false;
46+
47+
public function validateApiRequest() {
48+
49+
if(!$this->is_submitted){
50+
return false;
51+
}
52+
53+
$form = $this->getUserForm();
54+
if(!$form){ return array('error_code' => 1); }
55+
56+
// загружаем модель пользователя
57+
$this->users_model = cmsCore::getModel('users');
58+
59+
$user = $form->parse($this->request, true);
60+
61+
$errors = $form->validate($this, $user, false);
62+
63+
if (mb_strlen($user['password1']) < 6) {
64+
$errors['password1'] = sprintf(ERR_VALIDATE_MIN_LENGTH, 6);
65+
}
66+
67+
if($errors){
68+
69+
return array(
70+
'error_code' => 100,
71+
'error_msg' => '',
72+
'request_params' => $errors
73+
);
74+
75+
}
76+
77+
$result = $this->users_model->addUser($user);
78+
79+
if (!$result['success']){
80+
81+
return array(
82+
'error_code' => 100,
83+
'error_msg' => '',
84+
'request_params' => (array)$result['errors']
85+
);
86+
87+
}
88+
89+
$user['id'] = $result['id'];
90+
91+
cmsUser::setUPS('first_auth', 1, $user['id']);
92+
93+
$this->user = $user;
94+
95+
return false;
96+
97+
}
98+
99+
public function run(){
100+
101+
if(!$this->is_submitted){
102+
return $this->returnForm();
103+
}
104+
105+
$this->result = array(
106+
'user_id' => $this->user['id'],
107+
'is_verify_email' => false,
108+
'success_text' => sprintf(LANG_CP_USER_CREATED, $this->user['nickname'])
109+
);
110+
111+
}
112+
113+
private function returnForm() {
114+
115+
$this->result = array();
116+
117+
$form = $this->getUserForm();
118+
if(!$form){ return; }
119+
120+
$this->result['item'] = form_to_params($form);
121+
$this->result['sig'] = get_sig();
122+
123+
}
124+
125+
private function getUserForm() {
126+
127+
cmsCore::loadControllerLanguage('admin');
128+
129+
$form = $this->getControllerForm('admin', 'user', array('add'));
130+
if(!$form){ return false; }
131+
132+
$form->removeFieldset('permissions');
133+
134+
return $form;
135+
136+
}
137+
138+
}

‎package/system/controllers/api/backend/forms/form_key.php‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/******************************************************************************/
33
// //
4-
// InstantMedia 2016 //
4+
// InstantMedia 2017 //
55
// http://instantmedia.ru/, support@instantmedia.ru //
66
// written by Fuze //
77
// //
@@ -11,6 +11,24 @@ class formApiKey extends cmsForm {
1111

1212
public function init() {
1313

14+
$generator = function($item){
15+
static $items = null;
16+
if($items === null){
17+
$api_actions = cmsCore::getFilesList('system/controllers/api/api_actions/', 'api_*.php');
18+
$actions = cmsCore::getFilesList('system/controllers/api/actions/', 'api_*.php');
19+
$hooks = cmsCore::getFilesList('system/controllers/api/hooks/', 'api_*.php');
20+
$files = array_unique(array_merge($hooks, $actions, $api_actions));
21+
$items = array();
22+
if ($files) {
23+
foreach ($files as $file_name) {
24+
$name = str_replace(array('api_', '.php'), '', $file_name);
25+
$items[$name] = $name;
26+
}
27+
}
28+
}
29+
return $items;
30+
};
31+
1432
return array(
1533

1634
array(
@@ -44,7 +62,20 @@ public function init() {
4462

4563
new fieldText('ip_access', array(
4664
'title' => LANG_API_ALLOW_IPS,
47-
'hint' => LANG_CP_SETTINGS_ALLOW_IPS_HINT
65+
'hint' => sprintf(LANG_CP_SETTINGS_ALLOW_IPS_HINT, cmsUser::getIp())
66+
)),
67+
68+
new fieldListMultiple('methods_access:allow', array(
69+
'title' => LANG_API_ALLOW_METHODS,
70+
'default' => 0,
71+
'show_all' => true,
72+
'generator' => $generator
73+
)),
74+
75+
new fieldListMultiple('methods_access:disallow', array(
76+
'title' => LANG_API_DISALLOW_METHODS,
77+
'default' => 0,
78+
'generator' => $generator
4879
))
4980

5081
)

‎package/system/controllers/api/frontend.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/******************************************************************************/
33
// //
4-
// InstantMedia 2016 //
4+
// InstantMedia 2017 //
55
// http://instantmedia.ru/, support@instantmedia.ru //
66
// written by Fuze //
77
// //

‎package/system/controllers/api/model.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,11 @@ public function getKey($id) {
1717
$field = 'api_key';
1818
}
1919

20-
return $this->filterEqual($field, $id)->getItem('api_keys');
20+
$key = $this->filterEqual($field, $id)->getItem('api_keys');
21+
22+
$key['methods_access'] = cmsModel::yamlToArray($key['methods_access']);
23+
24+
return $key;
2125

2226
}
2327

0 commit comments

Comments
 (0)