/var-www-hotglue/hotglue.org-test/dev/json.php

Go to the documentation of this file.

<?php

/**
 *      json.php
 *      HTTP request handler for JSON-encoded AJAX calls
 *
 *      Copyright Gottfried Haider, Danja Vasiliev 2010.
 *      This source code is licensed under the GNU General Public License.
 *      See the file COPYING for more details.
 */

@require_once('config.inc.php');
require_once('log.inc.php');
log_msg('info', '--- json request ---');
require_once('common.inc.php');
require_once('modules.inc.php');
require_once('util.inc.php');


// set mime type and encoding first
header('Content-Type: application/json; charset=UTF-8');

// get method and arguments
$args = array();
switch ($_SERVER['REQUEST_METHOD']) {
        // we don't use $_REQUEST here because this includes cookies as well
        // disable support for GET to make cross site request forgery (xsrf) 
        // at least harder to do
        //case 'GET':
        //      foreach ($_GET as $key=>$val) {
        //              if (get_magic_quotes_gpc()) {
        //                      $val = stripslashes($val);
        //              }
        //              $dec = @json_decode($val, true);
        //              if ($dec === NULL) {
        //                      $err = response('Error decoding the argument '.quot($key).' => '.var_dump_inl($val), 400);
        //                      echo json_encode($err);
        //                      log_msg('warn', 'json: '.$err['#data']);
        //                      die();
        //              } else {
        //                      $args[$key] = $dec;
        //              }
        //      }
        //      break;
        case 'POST':
                foreach ($_POST as $key=>$val) {
                        if (get_magic_quotes_gpc()) {
                                $val = stripslashes($val);
                        }
                        $dec = @json_decode($val, true);
                        if ($dec === NULL) {
                                $err = response('Error decoding the argument '.quot($key).' => '.var_dump_inl($val), 400);
                                echo json_encode($err);
                                log_msg('warn', 'json: '.$err['#data']);
                                die();
                        } else {
                                $args[$key] = $dec;
                        }
                }
                break;
        default:
                //$err = response('Only HTTP GET and POST requests supported', 400);
                $err = response('Only HTTP POST requests supported', 400);
                echo json_encode($err);
                log_msg('warn', 'json: '.$err['#data']);
                die();
}

// check if we got a method argument
if (!empty($args['method'])) {
        $method = $args['method'];
        unset($args['method']);
        log_msg('debug', 'json: method is '.quot($method));
        log_msg('debug', 'json: arguments are '.var_dump_inl($args));
        log_msg('debug', 'json: base url is '.quot(base_url()));
} else {
        // this can also be caused by an upload exceeding the limits 
        // set in php.ini
        $err = response('Required argument "method" missing', 400);
        echo json_encode($err);
        log_msg('warn', 'json: '.$err['#data']);
        die();
}

load_modules($method);

if (!($m = get_service($method))) {
        $err = response('Unknown method '.quot($method), 400);
        echo json_encode($err);
        log_msg('warn', 'json: '.$err['#data']);
        die();
}

// check authentication
if (isset($m['auth']) && $m['auth']) {
        if (!is_auth()) {
                prompt_auth(true);
        }
}

if (isset($m['cross-origin']) && $m['cross-origin']) {
        // output cross-origin header if requested
        header('Access-Controll-Allow-Origin: *');
} else {
        // otherwise check the referer to make xsrf harder
        if (!empty($_SERVER['HTTP_REFERER'])) {
                $bu = base_url();
                if (substr($_SERVER['HTTP_REFERER'], 0, strlen($bu)) != $bu) {
                        echo json_encode(response('Cross-origin requests not supported for this method', 400));
                        log_msg('warn', 'json: possible xsrf detected, referer is '.quot($_SERVER['HTTP_REFERER']).', arguments '.var_dump_inl($args));
                        die();
                }
        }
}

// run service and output result
$ret = run_service($method, $args);
if (is_array($ret) && isset($ret['#error']) && $ret['#error']) {
        log_msg('warn', 'json: service '.$method.' returned error '.quot($ret['#data']));
} elseif (is_array($ret) && isset($ret['#data'])) {
        log_msg('debug', 'json: service returned '.var_dump_inl($ret['#data']));
}
echo json_encode($ret);

---