json-api-auth.php

<?php

/*

  Plugin Name: JSON API Auth  
  Plugin URI: http://www.parorrey.com/solutions/json-api-auth/
  Description: Extends the JSON API Plugin for RESTful user authentication
  Version: 3.1.3
  Requires at least: 3.0.1
  Requires PHP: 7.4
  Tested up to: 7.1
  Author: Ali Qureshi
  Author URI: http://www.parorrey.com
  License: GPLv3
  
 */

include_once(ABSPATH . 'wp-admin/includes/plugin.php');

define('JSON_API_AUTH_HOME', dirname(__FILE__));
define('JSON_API_AUTH_VERSION', '3.1.3');
define('JSON_API_AUTH_MIN_JSON_API_VERSION', '2.3.1');

register_activation_hook(__FILE__, 'json_api_auth_security_upgrade');
add_action('init', 'json_api_auth_maybe_security_upgrade', 0);

/**
 * Remove response transients created by vulnerable JSON API releases.
 */
function json_api_auth_security_upgrade()
{
  global $wpdb;

  if (isset($wpdb) && isset($wpdb->options)) {
    $value_like = $wpdb->esc_like('_transient_json-api-') . '%';
    $timeout_like = $wpdb->esc_like('_transient_timeout_json-api-') . '%';
    $wpdb->query(
      $wpdb->prepare(
        "DELETE FROM {$wpdb->options} WHERE option_name LIKE %s OR option_name LIKE %s",
        $value_like,
        $timeout_like
      )
    );
  }

  foreach (array('generate_auth_cookie', 'validate_auth_cookie', 'get_currentuserinfo') as $method) {
    delete_transient('json-api-' . $method);
    wp_cache_delete('json-api-' . $method, 'transient');
  }

  update_option('json_api_auth_security_version', JSON_API_AUTH_VERSION, false);
}

function json_api_auth_maybe_security_upgrade()
{
  if (get_option('json_api_auth_security_version') !== JSON_API_AUTH_VERSION) {
    json_api_auth_security_upgrade();
  }
}

function json_api_auth_parent_plugin_file()
{
  foreach (array('json-api/json-api.php', 'json-api-master/json-api.php') as $plugin_file) {
    if (is_plugin_active($plugin_file)) {
      return $plugin_file;
    }
  }
  return false;
}

function json_api_auth_parent_is_secure($plugin_file)
{
  $headers = get_file_data(
    WP_PLUGIN_DIR . '/' . $plugin_file,
    array('Version' => 'Version'),
    'plugin'
  );
  return !empty($headers['Version']) && version_compare($headers['Version'], JSON_API_AUTH_MIN_JSON_API_VERSION, '>=');
}

function auth_action_links($links)
{

  $links[] = '<a href="' . esc_url(get_admin_url(null, '/options-general.php?page=json-api')) . '">JSON API</a>';

  $links[] = '<a href="https://www.parorrey.com/solutions/json-api-user-plus/" target="_blank">' . __('Upgrade to User Plus', 'json-api-auth') . '</a>';

  return $links;
}
add_filter('plugin_action_links_' . plugin_basename(__FILE__), 'auth_action_links', 10, 1);


$json_api_auth_parent = json_api_auth_parent_plugin_file();

if (!$json_api_auth_parent) {

  add_action('admin_notices', 'pim_auth_draw_notice_json_api');

  return;

}

if (!json_api_auth_parent_is_secure($json_api_auth_parent)) {
  add_action('admin_notices', 'pim_auth_draw_notice_insecure_json_api');
  return;
}

add_filter('json_api_controllers', 'pimAuthJsonApiController');

add_filter('json_api_auth_controller_path', 'setAuthControllerPath');

add_action('init', 'json_api_auth_checkAuthCookie', 100);

load_plugin_textdomain('json-api-auth', false, basename(dirname(__FILE__)) . '/languages');

function pim_auth_draw_notice_json_api()
{

  echo '<div id="message" class="error fade"><p style="line-height: 150%">';

  _e('<strong>JSON API Auth</strong></a> requires the JSON API plugin to be activated. Please <a href="https://github.com/PI-Media/json-api">install / activate JSON API</a> first from <a href="https://github.com/PI-Media/json-api" target="_blank">GitHub repository here</a>. <br>You can also upgrade to a pro verison <a href="http://www.parorrey.com/solutions/json-api-user-plus/" target="_blank">JSON API User Plus</a> for JSON API Auth.', 'json-api-auth');

  echo '</p></div>';

}

function pim_auth_draw_notice_insecure_json_api()
{
  echo '<div class="notice notice-error"><p>';
  echo wp_kses_post(
    sprintf(
      __('<strong>JSON API Auth is disabled for safety.</strong> Update the required JSON API plugin to version %s or later. Older releases can cache and replay authentication cookies.', 'json-api-auth'),
      esc_html(JSON_API_AUTH_MIN_JSON_API_VERSION)
    )
  );
  echo '</p></div>';
}


function pimAuthJsonApiController($aControllers)
{

  $aControllers[] = 'Auth';
  return $aControllers;

}


function setAuthControllerPath($sDefaultPath)
{

  return dirname(__FILE__) . '/controllers/Auth.php';

}

function json_api_auth_checkAuthCookie($sDefaultPath)
{
  global $json_api;

  if ( isset( $json_api->query->cookie ) && $json_api->query->cookie ) {
    $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in');
    if ($user_id) {
      $user = get_userdata($user_id);

      wp_set_current_user($user->ID, $user->user_login);
    }
  }
}