Skip to content

Commit 8358c1e

Browse files
mevdscheemevdschee
committed
Merge branch 'main' of github.com:mevdschee/php-crud-api
2 parents f85d85f + 50bc0cb commit 8358c1e

File tree

4 files changed

+50
-7
lines changed

4 files changed

+50
-7
lines changed

‎README.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -664,6 +664,7 @@ You can enable the following middleware using the "middlewares" config parameter
664664
- "apiKeyAuth": Support for "API Key Authentication"
665665
- "apiKeyDbAuth": Support for "API Key Database Authentication"
666666
- "dbAuth": Support for "Database Authentication"
667+
- "wpAuth": Support for "Wordpress Authentication"
667668
- "jwtAuth": Support for "JWT Authentication"
668669
- "basicAuth": Support for "Basic Authentication"
669670
- "reconnect": Reconnect to the database with different parameters
@@ -716,6 +717,10 @@ You can tune the middleware behavior using middleware specific configuration par
716717
- "dbAuth.loginAfterRegistration": 1 or zero if registered users should be logged in after registration ("")
717718
- "dbAuth.passwordLength": Minimum length that the password must have ("12")
718719
- "dbAuth.sessionName": The name of the PHP session that is started ("")
720+
- "wpAuth.mode": Set to "optional" if you want to allow anonymous access ("required")
721+
- "wpAuth.wpDirectory": The folder/path where the Wordpress install can be found (".")
722+
- "wpAuth.usernameFormField": The name of the form field that holds the username ("username")
723+
- "wpAuth.passwordFormField": The name of the form field that holds the password ("password")
719724
- "jwtAuth.mode": Set to "optional" if you want to allow anonymous access ("required")
720725
- "jwtAuth.header": Name of the header containing the JWT token ("X-Authorization")
721726
- "jwtAuth.leeway": The acceptable number of seconds of clock skew ("5")
@@ -841,6 +846,27 @@ For login operations, it is possible to use a view as the usersTable. Such view
841846

842847
However, views with joined tables are not insertable ([see issue 907](https://github.com/mevdschee/php-crud-api/issues/907) ). As a workaround, use the property ***loginTable*** to set a different reference table for login. The **usersTable** will still be set to the normal, insertable users table.
843848

849+
#### Wordpress authentication
850+
851+
The Wordpress authentication middleware defines three routes:
852+
853+
method path - parameters - description
854+
---------------------------------------------------------------------------------------------------
855+
GET /me - - returns the user that is currently logged in
856+
POST /login - username, password - logs a user in by username and password
857+
POST /logout - - logs out the currently logged in user
858+
859+
A user can be logged in by sending it's username and password to the login endpoint (in JSON format).
860+
The user can be logged out by sending a POST request with an empty body to the logout endpoint.
861+
You need to specify the Wordpress installation directory using the "wpAuth.wpDirectory" configuration parameter.
862+
The middleware calls "wp-load.php" this allows you to use Wordpress functions in the authorization middleware, like:
863+
864+
- wp_get_current_user()
865+
- is_user_logged_in()
866+
- is_super_admin()
867+
- user_can(wp_get_current_user(),'edit_posts');
868+
869+
Note that the `$_SESSION` variable is not used by this middleware.
844870

845871
#### Basic authentication
846872

‎api.include.php

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3306,7 +3306,7 @@ public function fromGlobals(): ServerRequestInterface
33063306
/**
33073307
* {@inheritdoc}
33083308
*/
3309-
public function fromArrays(array $server, array $headers = [], array $cookie = [], array $get = [], /*?array*/ $post = null, array $files = [], $body = null): ServerRequestInterface
3309+
public function fromArrays(array $server, array $headers = [], array $cookie = [], array $get = [], ?array $post = null, array $files = [], $body = null): ServerRequestInterface
33103310
{
33113311
$method = $this->getMethodFromEnv($server);
33123312
$uri = $this->getUriFromEnvWithHTTP($server);
@@ -3575,7 +3575,8 @@ public function fromArrays(
35753575
array $server,
35763576
array $headers = [],
35773577
array $cookie = [],
3578-
array $get = [], /*?array*/ $post = null,
3578+
array $get = [],
3579+
?array $post = null,
35793580
array $files = [],
35803581
$body = null
35813582
): ServerRequestInterface;
@@ -9987,20 +9988,25 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
99879988
'remember' => false,
99889989
]);
99899990
if ($user->ID) {
9991+
unset($user->data->user_pass);
99909992
return $this->responder->success($user);
99919993
}
99929994
return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
99939995
}
99949996
if ($method == 'POST' && $path == 'logout') {
99959997
if (is_user_logged_in()) {
99969998
wp_logout();
9999+
$user = wp_get_current_user();
10000+
unset($user->data->user_pass);
999710001
return $this->responder->success($user);
999810002
}
999910003
return $this->responder->error(ErrorCode::AUTHENTICATION_REQUIRED, '');
1000010004
}
1000110005
if ($method == 'GET' && $path == 'me') {
1000210006
if (is_user_logged_in()) {
10003-
return $this->responder->success(wp_get_current_user());
10007+
$user = wp_get_current_user();
10008+
unset($user->data->user_pass);
10009+
return $this->responder->success($user);
1000410010
}
1000510011
return $this->responder->error(ErrorCode::AUTHENTICATION_REQUIRED, '');
1000610012
}

‎api.php

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3306,7 +3306,7 @@ public function fromGlobals(): ServerRequestInterface
33063306
/**
33073307
* {@inheritdoc}
33083308
*/
3309-
public function fromArrays(array $server, array $headers = [], array $cookie = [], array $get = [], /*?array*/ $post = null, array $files = [], $body = null): ServerRequestInterface
3309+
public function fromArrays(array $server, array $headers = [], array $cookie = [], array $get = [], ?array $post = null, array $files = [], $body = null): ServerRequestInterface
33103310
{
33113311
$method = $this->getMethodFromEnv($server);
33123312
$uri = $this->getUriFromEnvWithHTTP($server);
@@ -3575,7 +3575,8 @@ public function fromArrays(
35753575
array $server,
35763576
array $headers = [],
35773577
array $cookie = [],
3578-
array $get = [], /*?array*/ $post = null,
3578+
array $get = [],
3579+
?array $post = null,
35793580
array $files = [],
35803581
$body = null
35813582
): ServerRequestInterface;
@@ -9987,20 +9988,25 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
99879988
'remember' => false,
99889989
]);
99899990
if ($user->ID) {
9991+
unset($user->data->user_pass);
99909992
return $this->responder->success($user);
99919993
}
99929994
return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
99939995
}
99949996
if ($method == 'POST' && $path == 'logout') {
99959997
if (is_user_logged_in()) {
99969998
wp_logout();
9999+
$user = wp_get_current_user();
10000+
unset($user->data->user_pass);
999710001
return $this->responder->success($user);
999810002
}
999910003
return $this->responder->error(ErrorCode::AUTHENTICATION_REQUIRED, '');
1000010004
}
1000110005
if ($method == 'GET' && $path == 'me') {
1000210006
if (is_user_logged_in()) {
10003-
return $this->responder->success(wp_get_current_user());
10007+
$user = wp_get_current_user();
10008+
unset($user->data->user_pass);
10009+
return $this->responder->success($user);
1000410010
}
1000510011
return $this->responder->error(ErrorCode::AUTHENTICATION_REQUIRED, '');
1000610012
}

‎src/Tqdev/PhpCrudApi/Middleware/WpAuthMiddleware.php

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,20 +38,25 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
3838
'remember' => false,
3939
]);
4040
if ($user->ID) {
41+
unset($user->data->user_pass);
4142
return $this->responder->success($user);
4243
}
4344
return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
4445
}
4546
if ($method == 'POST' && $path == 'logout') {
4647
if (is_user_logged_in()) {
4748
wp_logout();
49+
$user = wp_get_current_user();
50+
unset($user->data->user_pass);
4851
return $this->responder->success($user);
4952
}
5053
return $this->responder->error(ErrorCode::AUTHENTICATION_REQUIRED, '');
5154
}
5255
if ($method == 'GET' && $path == 'me') {
5356
if (is_user_logged_in()) {
54-
return $this->responder->success(wp_get_current_user());
57+
$user = wp_get_current_user();
58+
unset($user->data->user_pass);
59+
return $this->responder->success($user);
5560
}
5661
return $this->responder->error(ErrorCode::AUTHENTICATION_REQUIRED, '');
5762
}

0 commit comments

Comments
 (0)