Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 3f99a90

Browse files
author
fuze
committed
ограничения в методах для ключей,
новый метод users.add http://docs.instantcms.ru/manual/components/api/methods/users-add + мелкие правки
1 parent e11eacb commit 3f99a90

File tree

13 files changed

+218
-15
lines changed

13 files changed

+218
-15
lines changed

‎install.sql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ CREATE TABLE `{#}api_keys` (
55
`api_key` varchar(32) DEFAULT NULL,
66
`description` varchar(100) DEFAULT NULL,
77
`ip_access` text,
8+
`key_methods` text,
89
PRIMARY KEY (`id`),
910
UNIQUE KEY `api_key` (`api_key`)
1011
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

‎manifest.en.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ image = "icon.png"
66
major = "2"
77
minor = "0"
88
build = "0"
9-
date = "20160101"
9+
date = "20170505"
1010

1111
[depends]
1212
core = "2.5.0"

‎manifest.ru.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ image = "icon.png"
66
major = "2"
77
minor = "0"
88
build = "0"
9-
date = "20160101"
9+
date = "20170505"
1010

1111
[depends]
1212
core = "2.5.0"

‎package/system/controllers/api/actions/method.php‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,28 @@
11
<?php
22
/******************************************************************************/
33
// //
4-
// InstantMedia 2016 //
4+
// InstantMedia 2017 //
55
// http://instantmedia.ru/, support@instantmedia.ru //
66
// written by Fuze //
77
// //
88
/******************************************************************************/
99

1010
class actionApiMethod extends cmsAction {
1111

12-
private $key = null;
13-
1412
private $method_name = null;
1513
private $method_params = array();
1614
private $method_controller_name = null;
1715
private $method_action_name = null;
1816

17+
/**
18+
* Объект контроллера api метода
19+
* @var object
20+
*/
1921
private $method_controller = null;
22+
/**
23+
* Объект класса api метода
24+
* @var object
25+
*/
2026
private $method_action = null;
2127

2228
public function __construct($controller, $params=array()){
@@ -310,6 +316,16 @@ public function checkRequest() {
310316
return $this->error(23);
311317
}
312318

319+
$method_name = str_replace('.', '_', $this->method_name);
320+
321+
$is_view = !$this->key['methods_access']['allow'] || in_array($method_name, $this->key['methods_access']['allow']);
322+
$is_hide = $this->key['methods_access']['disallow'] && in_array($method_name, $this->key['methods_access']['disallow']);
323+
324+
// првоеряем доступ к методу
325+
if (!$is_view || $is_hide) {
326+
return $this->error(24);
327+
}
328+
313329
return true;
314330

315331
}

‎package/system/controllers/api/api_actions/api_content_get.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,8 @@ public function run($ctype_name){
277277
list($this->ctype, $items) = cmsEventsManager::hook("content_{$this->ctype['name']}_before_list", array($this->ctype, $items));
278278
list($this->ctype, $items) = cmsEventsManager::hook('content_api_list', array($this->ctype, $items));
279279

280+
$result_items = array();
281+
280282
if($items){
281283
foreach ($items as $key => $item) {
282284

@@ -306,6 +308,9 @@ public function run($ctype_name){
306308
}
307309

308310
}
311+
312+
$result_items[] = $items[$key];
313+
309314
}
310315
}
311316

@@ -314,7 +319,7 @@ public function run($ctype_name){
314319
}
315320

316321
$this->result['count'] = $total;
317-
$this->result['items'] = $items;
322+
$this->result['items'] = $result_items;
318323
$this->result['additionally'] = array(
319324
'fields' => $fields,
320325
'props' => $props,

‎package/system/controllers/api/api_actions/api_content_get_item.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,13 @@ public function validateApiRequest($ctype_name=null) {
7171
}
7272
}
7373

74+
// Проверяем, что не удалено
75+
if (!empty($this->item['is_deleted'])){
76+
if (!$is_moderator){
77+
return array('error_msg' => LANG_API_ERROR100);
78+
}
79+
}
80+
7481
// Проверяем приватность
7582
if ($this->item['is_private'] == 1){ // доступ только друзьям
7683

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
<?php
2+
3+
class actionUsersApiUsersAdd extends cmsAction {
4+
5+
public function __construct($controller, $params=array()) {
6+
7+
parent::__construct($controller, $params);
8+
9+
$this->is_submitted = $this->request->has('submit');
10+
11+
if($this->is_submitted){
12+
$this->check_sig = true;
13+
}
14+
15+
}
16+
17+
/**
18+
* Блокировка прямого вызова экшена
19+
* обязательное свойство
20+
* @var boolean
21+
*/
22+
public $lock_explicit_call = true;
23+
/**
24+
* Результат запроса
25+
* обязательное свойство
26+
* @var array
27+
*/
28+
public $result;
29+
/**
30+
* Флаг, обязующий проверять параметр sig запроса
31+
* sig привязан к домену сайта и к ip адресу посетителя
32+
* @var boolean
33+
*/
34+
public $check_sig = false;
35+
36+
/**
37+
* Возможные параметры запроса
38+
* с правилами валидации
39+
* Если запрос имеет параметры, необходимо описать их здесь
40+
* Правила валидации параметров задаются по аналогии с полями форм
41+
* @var array
42+
*/
43+
public $request_params = array();
44+
45+
private $is_submitted = false;
46+
47+
public function validateApiRequest() {
48+
49+
if(!$this->is_submitted){
50+
return false;
51+
}
52+
53+
$form = $this->getUserForm();
54+
if(!$form){ return array('error_code' => 1); }
55+
56+
// загружаем модель пользователя
57+
$this->users_model = cmsCore::getModel('users');
58+
59+
$user = $form->parse($this->request, true);
60+
61+
$errors = $form->validate($this, $user, false);
62+
63+
if (mb_strlen($user['password1']) < 6) {
64+
$errors['password1'] = sprintf(ERR_VALIDATE_MIN_LENGTH, 6);
65+
}
66+
67+
if($errors){
68+
69+
return array(
70+
'error_code' => 100,
71+
'error_msg' => '',
72+
'request_params' => $errors
73+
);
74+
75+
}
76+
77+
$result = $this->users_model->addUser($user);
78+
79+
if (!$result['success']){
80+
81+
return array(
82+
'error_code' => 100,
83+
'error_msg' => '',
84+
'request_params' => (array)$result['errors']
85+
);
86+
87+
}
88+
89+
$user['id'] = $result['id'];
90+
91+
cmsUser::setUPS('first_auth', 1, $user['id']);
92+
93+
$this->user = $user;
94+
95+
return false;
96+
97+
}
98+
99+
public function run(){
100+
101+
if(!$this->is_submitted){
102+
return $this->returnForm();
103+
}
104+
105+
$this->result = array(
106+
'user_id' => $this->user['id'],
107+
'is_verify_email' => false,
108+
'success_text' => sprintf(LANG_CP_USER_CREATED, $this->user['nickname'])
109+
);
110+
111+
}
112+
113+
private function returnForm() {
114+
115+
$this->result = array();
116+
117+
$form = $this->getUserForm();
118+
if(!$form){ return; }
119+
120+
$this->result['item'] = form_to_params($form);
121+
$this->result['sig'] = get_sig();
122+
123+
}
124+
125+
private function getUserForm() {
126+
127+
cmsCore::loadControllerLanguage('admin');
128+
129+
$form = $this->getControllerForm('admin', 'user', array('add'));
130+
if(!$form){ return false; }
131+
132+
$form->removeFieldset('permissions');
133+
134+
return $form;
135+
136+
}
137+
138+
}

‎package/system/controllers/api/backend/forms/form_key.php‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/******************************************************************************/
33
// //
4-
// InstantMedia 2016 //
4+
// InstantMedia 2017 //
55
// http://instantmedia.ru/, support@instantmedia.ru //
66
// written by Fuze //
77
// //
@@ -11,6 +11,24 @@ class formApiKey extends cmsForm {
1111

1212
public function init() {
1313

14+
$generator = function($item){
15+
static $items = null;
16+
if($items === null){
17+
$api_actions = cmsCore::getFilesList('system/controllers/api/api_actions/', 'api_*.php');
18+
$actions = cmsCore::getFilesList('system/controllers/api/actions/', 'api_*.php');
19+
$hooks = cmsCore::getFilesList('system/controllers/api/hooks/', 'api_*.php');
20+
$files = array_unique(array_merge($hooks, $actions, $api_actions));
21+
$items = array();
22+
if ($files) {
23+
foreach ($files as $file_name) {
24+
$name = str_replace(array('api_', '.php'), '', $file_name);
25+
$items[$name] = $name;
26+
}
27+
}
28+
}
29+
return $items;
30+
};
31+
1432
return array(
1533

1634
array(
@@ -44,7 +62,20 @@ public function init() {
4462

4563
new fieldText('ip_access', array(
4664
'title' => LANG_API_ALLOW_IPS,
47-
'hint' => LANG_CP_SETTINGS_ALLOW_IPS_HINT
65+
'hint' => sprintf(LANG_CP_SETTINGS_ALLOW_IPS_HINT, cmsUser::getIp())
66+
)),
67+
68+
new fieldListMultiple('methods_access:allow', array(
69+
'title' => LANG_API_ALLOW_METHODS,
70+
'default' => 0,
71+
'show_all' => true,
72+
'generator' => $generator
73+
)),
74+
75+
new fieldListMultiple('methods_access:disallow', array(
76+
'title' => LANG_API_DISALLOW_METHODS,
77+
'default' => 0,
78+
'generator' => $generator
4879
))
4980

5081
)

‎package/system/controllers/api/frontend.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/******************************************************************************/
33
// //
4-
// InstantMedia 2016 //
4+
// InstantMedia 2017 //
55
// http://instantmedia.ru/, support@instantmedia.ru //
66
// written by Fuze //
77
// //

‎package/system/controllers/api/model.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,11 @@ public function getKey($id) {
1717
$field = 'api_key';
1818
}
1919

20-
return $this->filterEqual($field, $id)->getItem('api_keys');
20+
$key = $this->filterEqual($field, $id)->getItem('api_keys');
21+
22+
$key['methods_access'] = cmsModel::yamlToArray($key['methods_access']);
23+
24+
return $key;
2125

2226
}
2327

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /