Update JsonRPC library and API
This commit is contained in:
Frederic Guillot
@@ -1,82 +0,0 @@
|
||||
<?php
|
||||
|
||||
namespace Kanboard\Api;
|
||||
|
||||
use JsonRPC\Exception\AuthenticationFailureException;
|
||||
|
||||
/**
|
||||
* Base class
|
||||
*
|
||||
* @package Kanboard\Api
|
||||
* @author Frederic Guillot
|
||||
*/
|
||||
class AuthApi extends BaseApi
|
||||
{
|
||||
/**
|
||||
* Check api credentials
|
||||
*
|
||||
* @access public
|
||||
* @param string $username
|
||||
* @param string $password
|
||||
* @param string $class
|
||||
* @param string $method
|
||||
* @throws AuthenticationFailureException
|
||||
*/
|
||||
public function checkCredentials($username, $password, $class, $method)
|
||||
{
|
||||
$this->dispatcher->dispatch('app.bootstrap');
|
||||
|
||||
if ($this->isUserAuthenticated($username, $password)) {
|
||||
$this->checkProcedurePermission(true, $method);
|
||||
$this->userSession->initialize($this->userModel->getByUsername($username));
|
||||
} elseif ($this->isAppAuthenticated($username, $password)) {
|
||||
$this->checkProcedurePermission(false, $method);
|
||||
} else {
|
||||
$this->logger->error('API authentication failure for '.$username);
|
||||
throw new AuthenticationFailureException('Wrong credentials');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check user credentials
|
||||
*
|
||||
* @access public
|
||||
* @param string $username
|
||||
* @param string $password
|
||||
* @return boolean
|
||||
*/
|
||||
private function isUserAuthenticated($username, $password)
|
||||
{
|
||||
return $username !== 'jsonrpc' &&
|
||||
! $this->userLockingModel->isLocked($username) &&
|
||||
$this->authenticationManager->passwordAuthentication($username, $password);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check administrative credentials
|
||||
*
|
||||
* @access public
|
||||
* @param string $username
|
||||
* @param string $password
|
||||
* @return boolean
|
||||
*/
|
||||
private function isAppAuthenticated($username, $password)
|
||||
{
|
||||
return $username === 'jsonrpc' && $password === $this->getApiToken();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get API Token
|
||||
*
|
||||
* @access private
|
||||
* @return string
|
||||
*/
|
||||
private function getApiToken()
|
||||
{
|
||||
if (defined('API_AUTHENTICATION_TOKEN')) {
|
||||
return API_AUTHENTICATION_TOKEN;
|
||||
}
|
||||
|
||||
return $this->configModel->get('api_token');
|
||||
}
|
||||
}
|
||||
@@ -13,51 +13,6 @@ use Kanboard\Core\Base;
|
||||
*/
|
||||
abstract class BaseApi extends Base
|
||||
{
|
||||
private $user_allowed_procedures = array(
|
||||
'getMe',
|
||||
'getMyDashboard',
|
||||
'getMyActivityStream',
|
||||
'createMyPrivateProject',
|
||||
'getMyProjectsList',
|
||||
'getMyProjects',
|
||||
'getMyOverdueTasks',
|
||||
);
|
||||
|
||||
private $both_allowed_procedures = array(
|
||||
'getTimezone',
|
||||
'getVersion',
|
||||
'getDefaultTaskColor',
|
||||
'getDefaultTaskColors',
|
||||
'getColorList',
|
||||
'getProjectById',
|
||||
'getTask',
|
||||
'getTaskByReference',
|
||||
'getAllTasks',
|
||||
'openTask',
|
||||
'closeTask',
|
||||
'moveTaskPosition',
|
||||
'createTask',
|
||||
'updateTask',
|
||||
'getBoard',
|
||||
'getProjectActivity',
|
||||
'getOverdueTasksByProject',
|
||||
'searchTasks',
|
||||
);
|
||||
|
||||
public function checkProcedurePermission($is_user, $procedure)
|
||||
{
|
||||
$is_both_procedure = in_array($procedure, $this->both_allowed_procedures);
|
||||
$is_user_procedure = in_array($procedure, $this->user_allowed_procedures);
|
||||
|
||||
if ($is_user && ! $is_both_procedure && ! $is_user_procedure) {
|
||||
throw new AccessDeniedException('Permission denied');
|
||||
} elseif (! $is_user && ! $is_both_procedure && $is_user_procedure) {
|
||||
throw new AccessDeniedException('Permission denied');
|
||||
}
|
||||
|
||||
$this->logger->debug('API call: '.$procedure);
|
||||
}
|
||||
|
||||
public function checkProjectPermission($project_id)
|
||||
{
|
||||
if ($this->userSession->isLogged() && ! $this->projectPermissionModel->isUserAllowed($project_id, $this->userSession->getId())) {
|
||||
|
||||
130
app/Api/Middleware/AuthenticationApiMiddleware.php
Normal file
130
app/Api/Middleware/AuthenticationApiMiddleware.php
Normal file
@@ -0,0 +1,130 @@
|
||||
<?php
|
||||
|
||||
namespace Kanboard\Api\Middleware;
|
||||
|
||||
use JsonRPC\Exception\AccessDeniedException;
|
||||
use JsonRPC\Exception\AuthenticationFailureException;
|
||||
use JsonRPC\MiddlewareInterface;
|
||||
use Kanboard\Core\Base;
|
||||
|
||||
/**
|
||||
* Class AuthenticationApiMiddleware
|
||||
*
|
||||
* @package Kanboard\Api\Middleware
|
||||
* @author Frederic Guillot
|
||||
*/
|
||||
class AuthenticationApiMiddleware extends Base implements MiddlewareInterface
|
||||
{
|
||||
private $user_allowed_procedures = array(
|
||||
'getMe',
|
||||
'getMyDashboard',
|
||||
'getMyActivityStream',
|
||||
'createMyPrivateProject',
|
||||
'getMyProjectsList',
|
||||
'getMyProjects',
|
||||
'getMyOverdueTasks',
|
||||
);
|
||||
|
||||
private $both_allowed_procedures = array(
|
||||
'getTimezone',
|
||||
'getVersion',
|
||||
'getDefaultTaskColor',
|
||||
'getDefaultTaskColors',
|
||||
'getColorList',
|
||||
'getProjectById',
|
||||
'getTask',
|
||||
'getTaskByReference',
|
||||
'getAllTasks',
|
||||
'openTask',
|
||||
'closeTask',
|
||||
'moveTaskPosition',
|
||||
'createTask',
|
||||
'updateTask',
|
||||
'getBoard',
|
||||
'getProjectActivity',
|
||||
'getOverdueTasksByProject',
|
||||
'searchTasks',
|
||||
);
|
||||
|
||||
/**
|
||||
* Execute Middleware
|
||||
*
|
||||
* @access public
|
||||
* @param string $username
|
||||
* @param string $password
|
||||
* @param string $procedureName
|
||||
* @throws AccessDeniedException
|
||||
* @throws AuthenticationFailureException
|
||||
*/
|
||||
public function execute($username, $password, $procedureName)
|
||||
{
|
||||
$this->dispatcher->dispatch('app.bootstrap');
|
||||
|
||||
if ($this->isUserAuthenticated($username, $password)) {
|
||||
$this->checkProcedurePermission(true, $procedureName);
|
||||
$this->userSession->initialize($this->userModel->getByUsername($username));
|
||||
} elseif ($this->isAppAuthenticated($username, $password)) {
|
||||
$this->checkProcedurePermission(false, $procedureName);
|
||||
} else {
|
||||
$this->logger->error('API authentication failure for '.$username);
|
||||
throw new AuthenticationFailureException('Wrong credentials');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check user credentials
|
||||
*
|
||||
* @access public
|
||||
* @param string $username
|
||||
* @param string $password
|
||||
* @return boolean
|
||||
*/
|
||||
private function isUserAuthenticated($username, $password)
|
||||
{
|
||||
return $username !== 'jsonrpc' &&
|
||||
! $this->userLockingModel->isLocked($username) &&
|
||||
$this->authenticationManager->passwordAuthentication($username, $password);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check administrative credentials
|
||||
*
|
||||
* @access public
|
||||
* @param string $username
|
||||
* @param string $password
|
||||
* @return boolean
|
||||
*/
|
||||
private function isAppAuthenticated($username, $password)
|
||||
{
|
||||
return $username === 'jsonrpc' && $password === $this->getApiToken();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get API Token
|
||||
*
|
||||
* @access private
|
||||
* @return string
|
||||
*/
|
||||
private function getApiToken()
|
||||
{
|
||||
if (defined('API_AUTHENTICATION_TOKEN')) {
|
||||
return API_AUTHENTICATION_TOKEN;
|
||||
}
|
||||
|
||||
return $this->configModel->get('api_token');
|
||||
}
|
||||
|
||||
public function checkProcedurePermission($is_user, $procedure)
|
||||
{
|
||||
$is_both_procedure = in_array($procedure, $this->both_allowed_procedures);
|
||||
$is_user_procedure = in_array($procedure, $this->user_allowed_procedures);
|
||||
|
||||
if ($is_user && ! $is_both_procedure && ! $is_user_procedure) {
|
||||
throw new AccessDeniedException('Permission denied');
|
||||
} elseif (! $is_user && ! $is_both_procedure && $is_user_procedure) {
|
||||
throw new AccessDeniedException('Permission denied');
|
||||
}
|
||||
|
||||
$this->logger->debug('API call: '.$procedure);
|
||||
}
|
||||
}
|
||||
@@ -140,6 +140,7 @@ use Pimple\Container;
|
||||
* @property \Psr\Log\LoggerInterface $logger
|
||||
* @property \PicoDb\Database $db
|
||||
* @property \Symfony\Component\EventDispatcher\EventDispatcher $dispatcher
|
||||
* @property \JsonRPC\Server $api
|
||||
*/
|
||||
abstract class Base
|
||||
{
|
||||
|
||||
74
app/ServiceProvider/ApiProvider.php
Normal file
74
app/ServiceProvider/ApiProvider.php
Normal file
@@ -0,0 +1,74 @@
|
||||
<?php
|
||||
|
||||
namespace Kanboard\ServiceProvider;
|
||||
|
||||
use JsonRPC\Server;
|
||||
use Kanboard\Api\ActionApi;
|
||||
use Kanboard\Api\AppApi;
|
||||
use Kanboard\Api\BoardApi;
|
||||
use Kanboard\Api\CategoryApi;
|
||||
use Kanboard\Api\ColumnApi;
|
||||
use Kanboard\Api\CommentApi;
|
||||
use Kanboard\Api\FileApi;
|
||||
use Kanboard\Api\GroupApi;
|
||||
use Kanboard\Api\GroupMemberApi;
|
||||
use Kanboard\Api\LinkApi;
|
||||
use Kanboard\Api\MeApi;
|
||||
use Kanboard\Api\Middleware\AuthenticationApiMiddleware;
|
||||
use Kanboard\Api\ProjectApi;
|
||||
use Kanboard\Api\ProjectPermissionApi;
|
||||
use Kanboard\Api\SubtaskApi;
|
||||
use Kanboard\Api\SwimlaneApi;
|
||||
use Kanboard\Api\TaskApi;
|
||||
use Kanboard\Api\TaskLinkApi;
|
||||
use Kanboard\Api\UserApi;
|
||||
use Pimple\Container;
|
||||
use Pimple\ServiceProviderInterface;
|
||||
|
||||
/**
|
||||
* Class ApiProvider
|
||||
*
|
||||
* @package Kanboard\ServiceProvider
|
||||
* @author Frederic Guillot
|
||||
*/
|
||||
class ApiProvider implements ServiceProviderInterface
|
||||
{
|
||||
/**
|
||||
* Registers services on the given container.
|
||||
*
|
||||
* @param Container $container
|
||||
* @return Container
|
||||
*/
|
||||
public function register(Container $container)
|
||||
{
|
||||
$server = new Server();
|
||||
$server->setAuthenticationHeader(API_AUTHENTICATION_HEADER);
|
||||
$server->getMiddlewareHandler()
|
||||
->withMiddleware(new AuthenticationApiMiddleware($container))
|
||||
;
|
||||
|
||||
$server->getProcedureHandler()
|
||||
->withObject(new MeApi($container))
|
||||
->withObject(new ActionApi($container))
|
||||
->withObject(new AppApi($container))
|
||||
->withObject(new BoardApi($container))
|
||||
->withObject(new ColumnApi($container))
|
||||
->withObject(new CategoryApi($container))
|
||||
->withObject(new CommentApi($container))
|
||||
->withObject(new FileApi($container))
|
||||
->withObject(new LinkApi($container))
|
||||
->withObject(new ProjectApi($container))
|
||||
->withObject(new ProjectPermissionApi($container))
|
||||
->withObject(new SubtaskApi($container))
|
||||
->withObject(new SwimlaneApi($container))
|
||||
->withObject(new TaskApi($container))
|
||||
->withObject(new TaskLinkApi($container))
|
||||
->withObject(new UserApi($container))
|
||||
->withObject(new GroupApi($container))
|
||||
->withObject(new GroupMemberApi($container))
|
||||
;
|
||||
|
||||
$container['api'] = $server;
|
||||
return $container;
|
||||
}
|
||||
}
|
||||
@@ -47,4 +47,5 @@ $container->register(new Kanboard\ServiceProvider\ExternalLinkProvider());
|
||||
$container->register(new Kanboard\ServiceProvider\AvatarProvider());
|
||||
$container->register(new Kanboard\ServiceProvider\FilterProvider());
|
||||
$container->register(new Kanboard\ServiceProvider\QueueProvider());
|
||||
$container->register(new Kanboard\ServiceProvider\ApiProvider());
|
||||
$container->register(new Kanboard\ServiceProvider\PluginProvider());
|
||||
|
||||
Reference in New Issue
Block a user