cm_webservice.php 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315
  1. <?php
  2. use Chamilo\UserBundle\Entity\User;
  3. require_once(dirname(__FILE__).'/../inc/global.inc.php');
  4. $libpath = api_get_path(LIBRARY_PATH);
  5. /**
  6. * Error returned by one of the methods of the web service. Contains an error code and an error message
  7. */
  8. class WSCMError
  9. {
  10. /**
  11. * Error handler. This needs to be a class that implements the interface WSErrorHandler
  12. *
  13. * @var WSErrorHandler
  14. */
  15. protected static $_handler;
  16. /**
  17. * Error code
  18. *
  19. * @var int
  20. */
  21. public $code;
  22. /**
  23. * Error message
  24. *
  25. * @var string
  26. */
  27. public $message;
  28. /**
  29. * Constructor
  30. *
  31. * @param int Error code
  32. * @param string Error message
  33. */
  34. public function __construct($code, $message)
  35. {
  36. $this->code = $code;
  37. $this->message = $message;
  38. }
  39. /**
  40. * Sets the error handler
  41. *
  42. * @param WSErrorHandler $handler Error handler
  43. */
  44. public static function setErrorHandler($handler)
  45. {
  46. if($handler instanceof WSErrorHandler) {
  47. self::$_handler = $handler;
  48. }
  49. }
  50. /**
  51. * Returns the error handler
  52. *
  53. * @return WSErrorHandler Error handler
  54. */
  55. public static function getErrorHandler()
  56. {
  57. return self::$_handler;
  58. }
  59. /**
  60. * Transforms the error into an array
  61. *
  62. * @return array Associative array with code and message
  63. */
  64. public function toArray()
  65. {
  66. return array('code' => $this->code, 'message' => $this->message);
  67. }
  68. }
  69. /**
  70. * Interface that must be implemented by any error handler
  71. */
  72. interface WSCMErrorHandler
  73. {
  74. /**
  75. * Handle method
  76. *
  77. * @param WSError $error Error
  78. */
  79. public function handle($error);
  80. }
  81. /**
  82. * Main class of the webservice. Webservice classes extend this class
  83. */
  84. class WSCM
  85. {
  86. /**
  87. * Chamilo configuration
  88. *
  89. * @var array
  90. */
  91. protected $_configuration;
  92. /**
  93. * Constructor
  94. */
  95. public function __construct()
  96. {
  97. $this->_configuration = $GLOBALS['_configuration'];
  98. }
  99. /**
  100. * Verifies the API key
  101. *
  102. * @param string $secret_key Secret key
  103. * @return mixed WSError in case of failure, null in case of success
  104. */
  105. protected function verifyKey($secret_key)
  106. {
  107. $ip = trim($_SERVER['REMOTE_ADDR']);
  108. // if we are behind a reverse proxy, assume it will send the
  109. // HTTP_X_FORWARDED_FOR header and use this IP instead
  110. if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
  111. list($ip1,$ip2) = split(',',$_SERVER['HTTP_X_FORWARDED_FOR']);
  112. $ip = trim($ip1);
  113. }
  114. $security_key = $ip.$this->_configuration['security_key'];
  115. if(!api_is_valid_secret_key($secret_key, $security_key)) {
  116. return new WSCMError(1, "API key is invalid");
  117. } else {
  118. return null;
  119. }
  120. }
  121. /**
  122. * Verifies if the user is valid
  123. *
  124. * @param string $username of the user in chamilo
  125. * @param string $pass of the same user (in MD5 of SHA)
  126. *
  127. * @return mixed "valid" if username e password are correct! Else, return a message error
  128. */
  129. public function verifyUserPass($username, $pass)
  130. {
  131. $login = $username;
  132. $password = $pass;
  133. $userRepo = UserManager::getRepository();
  134. /** @var User $uData */
  135. $uData = $userRepo->findOneBy([
  136. 'username' => trim(addslashes($login))
  137. ]);
  138. if ($uData) {
  139. if ($uData->getAuthSource() == PLATFORM_AUTH_SOURCE) {
  140. $passwordEncoded = UserManager::encryptPassword($password, $uData);
  141. // Check the user's password
  142. if ($passwordEncoded == $uData->getPassword() && (trim($login) == $uData->getUsername())) {
  143. // Check if the account is active (not locked)
  144. if ($uData->getActive()) {
  145. // Check if the expiration date has not been reached
  146. $now = new DateTime();
  147. if ($uData->getExpirationDate() > $now || !$uData->getExpirationDate()) {
  148. return "valid";
  149. } else {
  150. return get_lang('AccountExpired');
  151. }
  152. } else {
  153. return get_lang('AccountInactive');
  154. }
  155. } else {
  156. return get_lang('InvalidId');
  157. }
  158. } else {
  159. return get_lang('AccountURLInactive');
  160. }
  161. }
  162. return get_lang('InvalidId');
  163. }
  164. /**
  165. * Gets the real user id based on the user id field name and value.
  166. * Note that if the user id field name is "chamilo_user_id", it will use the user id
  167. * in the system database
  168. *
  169. * @param string $user_id_field_name User id field name
  170. * @param string $user_id_value User id value
  171. * @return mixed System user id if the user was found, WSError otherwise
  172. */
  173. protected function getUserId($user_id_field_name, $user_id_value)
  174. {
  175. if ($user_id_field_name == "chamilo_user_id") {
  176. if (UserManager::is_user_id_valid(intval($user_id_value))) {
  177. return intval($user_id_value);
  178. } else {
  179. return new WSCMError(100, "User not found");
  180. }
  181. } else {
  182. $user_id = UserManager::get_user_id_from_original_id(
  183. $user_id_value,
  184. $user_id_field_name
  185. );
  186. if ($user_id == 0) {
  187. return new WSCMError(100, "User not found");
  188. } else {
  189. return $user_id;
  190. }
  191. }
  192. }
  193. /**
  194. * Gets the real course id based on the course id field name and value.
  195. * Note that if the course id field name is "chamilo_course_id", it will use the course id
  196. * in the system database
  197. *
  198. * @param string $course_id_field_name Course id field name
  199. * @param string $course_id_value Course id value
  200. * @return mixed System course id if the course was found, WSError otherwise
  201. */
  202. protected function getCourseId($course_id_field_name, $course_id_value)
  203. {
  204. if ($course_id_field_name == "chamilo_course_id") {
  205. if (CourseManager::get_course_code_from_course_id($course_id_value) != null) {
  206. return intval($course_id_value);
  207. } else {
  208. return new WSCMError(200, "Course not found");
  209. }
  210. } else {
  211. $courseId = CourseManager::get_course_code_from_original_id(
  212. $course_id_value,
  213. $course_id_field_name
  214. );
  215. if (empty($courseId)) {
  216. return new WSCMError(200, "Course not found");
  217. } else {
  218. return $courseId;
  219. }
  220. }
  221. }
  222. /**
  223. * Gets the real session id based on the session id field name and value.
  224. * Note that if the session id field name is "chamilo_session_id", it will use the session id
  225. * in the system database
  226. *
  227. * @param string $session_id_field_name Session id field name
  228. * @param string $session_id_value Session id value
  229. * @return mixed System session id if the session was found, WSError otherwise
  230. */
  231. protected function getSessionId($session_id_field_name, $session_id_value)
  232. {
  233. if ($session_id_field_name == "chamilo_session_id") {
  234. $session = SessionManager::fetch((int)$session_id_value);
  235. if(!empty($session)) {
  236. return intval($session_id_value);
  237. } else {
  238. return new WSCMError(300, "Session not found");
  239. }
  240. } else {
  241. $session_id = SessionManager::getSessionIdFromOriginalId(
  242. $session_id_value,
  243. $session_id_field_name
  244. );
  245. if($session_id == 0) {
  246. return new WSCMError(300, "Session not found");
  247. } else {
  248. return $session_id;
  249. }
  250. }
  251. }
  252. /**
  253. * Handles an error by calling the WSError error handler
  254. *
  255. * @param WSError $error Error
  256. */
  257. protected function handleError($error)
  258. {
  259. $handler = WSCMError::getErrorHandler();
  260. $handler->handle($error);
  261. }
  262. /**
  263. * Gets a successful result
  264. *
  265. * @return array Array with a code of 0 and a message 'Operation was successful'
  266. */
  267. protected function getSuccessfulResult()
  268. {
  269. return array('code' => 0, 'message' => 'Operation was successful');
  270. }
  271. /**
  272. * Test function. Returns the string success
  273. *
  274. * @return string Success
  275. */
  276. public function test()
  277. {
  278. return "success";
  279. }
  280. /**
  281. * *Strictly* reverts PHP's nl2br() effects (whether it was used in XHTML mode or not)
  282. * @param string $string
  283. * @return string
  284. */
  285. public function nl2br_revert($string)
  286. {
  287. return preg_replace('`<br(?: /)?>([\\n\\r])`', '$1', $string);
  288. }
  289. }