marc
/
CiviProxy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

implementing #16

This commit is contained in:
systopia 2017-07-31 16:32:58 +02:00
parent 053c3f5fb9
commit 3c825a8f55
3 changed files with 82 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
proxy/config.php
View File

@ -91,6 +91,10 @@ $rest_allowed_actions = array(
'getsingle' => array( 'getsingle' => array(
'first_name' => 'string', 'first_name' => 'string',
'last_name' => 'string', 'last_name' => 'string',
// the following means *all* remaining parameters will be
// added and sanitised as 'string'. Better leave it out
// if you know which parameters you expect
'*' => 'string',
), ),
), ),
), ),

94
proxy/proxy.php
View File

@ -152,51 +152,75 @@ function civiproxy_security_check($target, $quit=TRUE) {
*/ */
function civiproxy_get_parameters($valid_parameters) { function civiproxy_get_parameters($valid_parameters) {
$result = array(); $result = array();
$default_sanitation = NULL;
foreach ($valid_parameters as $name => $type) { foreach ($valid_parameters as $name => $type) {
if ($name == '*') {
// this sets default_sanitation
$default_sanitation = $type;
continue;
}
if (isset($_REQUEST[$name])) { if (isset($_REQUEST[$name])) {
$value = $_REQUEST[$name]; $result[$name] = civiproxy_sanitise($_REQUEST[$name], $type);
if ($type=='int') { }
$value = (int) $value; }
} elseif ($type == 'string') {
// TODO: sanitize? SQL? // process wildcard elements
$value = $value; if ($default_sanitation !== NULL) {
} elseif ($type == 'float2') { // i.e. we want the others too
// TODO: check if safe wrt l10n. rather use sprintf $remove_parameters = array('key', 'api_key', 'version', 'entity', 'action');
$value = number_format($value, 2, '.', ''); foreach ($_REQUEST as $name => $value) {
} elseif ($type == 'hex') { if (!in_array($name, $remove_parameters) && !isset($valid_parameters[$name])) {
// hex code $result[$name] = civiproxy_sanitise($value, $default_sanitation);
if (!preg_match("#^[0-9a-f]*$#i", $value)) {
error_log("CiviProxy: removed invalid hex parameter: " . $value);
$value = '';
}
} elseif ($type == 'email') {
// valid email
if (!preg_match("#^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$#i", $value)) {
error_log("CiviProxy: removed invalid email parameter: " . $value);
$value = '';
}
} elseif (is_array($type)) {
// this is a list of valid options
$requested_value = $value;
$value = '';
foreach ($type as $allowed_value) {
if ($requested_value === $allowed_value) {
$value = $requested_value;
break;
}
}
} else {
error_log("CiviProxy: unknown type '$type'. Ignored.");
$value = '';
} }
$result[$name] = $value;
} }
} }
return $result; return $result;
} }
/**
* sanitise the given value with the given sanitiation type
*/
function civiproxy_sanitise($value, $type) {
if ($type=='int') {
$value = (int) $value;
} elseif ($type == 'string') {
// TODO: sanitize? SQL?
$value = $value;
} elseif ($type == 'float2') {
// TODO: check if safe wrt l10n. rather use sprintf
$value = number_format($value, 2, '.', '');
} elseif ($type == 'hex') {
// hex code
if (!preg_match("#^[0-9a-f]*$#i", $value)) {
error_log("CiviProxy: removed invalid hex parameter: " . $value);
$value = '';
}
} elseif ($type == 'email') {
// valid email
if (!preg_match("#^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$#i", $value)) {
error_log("CiviProxy: removed invalid email parameter: " . $value);
$value = '';
}
} elseif (is_array($type)) {
// this is a list of valid options
$requested_value = $value;
$value = '';
foreach ($type as $allowed_value) {
if ($requested_value === $allowed_value) {
$value = $requested_value;
break;
}
}
} else {
error_log("CiviProxy: unknown type '$type'. Ignored.");
$value = '';
}
}
/** /**
* generates a CiviCRM REST API compliant error * generates a CiviCRM REST API compliant error
* and ends processing * and ends processing

2
proxy/rest.php
View File

@ -44,7 +44,7 @@ if (empty($credentials['api_key'])) {
// check if the call itself is allowed // check if the call itself is allowed
$action = civiproxy_get_parameters(array('entity' => 'string', 'action' => 'string', 'version' => 'int', 'json' => 'int', 'sequential' => 'int')); $action = civiproxy_get_parameters(array('entity' => 'string', 'action' => 'string', 'version' => 'int', 'json' => 'int', 'sequential' => 'int'));
if (!isset($action['version']) || $action['version'] != 3) { if (!isset($action['version']) || $action['version'] != 3) {
civiproxy_rest_error("Invalid entity/action."); civiproxy_rest_error("API 'version' information missing.");
} }
// in release 0.4, allowed entity/actions per IP were introduced. To introduce backward compatibility, // in release 0.4, allowed entity/actions per IP were introduced. To introduce backward compatibility,