[Summary view] [Print] [Text view]

   1  <?php
   2  // $Id: api.php,v 1.30 2006/01/03 05:13:32 glen Exp $
   3  // Copyright (c)2005, Glen Campbell. All rights reserved.
   4  // This page implements the Siteframe Beaumont API
   5  
   6  require_once  'siteframe.inc';
   7  
   8  // definitions
   9  define('API_VERSION', 1);
  10  
  11  // error(#) - returns a standard error message
  12  function error($code, $parm='', $http_status=0)
  13  {
  14      // build the new DOM document
  15      $doc = new DOMDocument('1.0', config('charset'));
  16      $doc->formatOutput = TRUE;
  17  
  18      // compute the error token
  19      $token = sprintf('api_error_%d', $code);
  20  
  21      // add an <Error> wrapper
  22      $root = $doc->appendChild($doc->createElement('Error'));
  23      
  24      // <Code>
  25      $num = $root->appendChild($doc->createElement('Code'));
  26      $num->appendChild($doc->createTextNode($code));
  27      
  28      // <Message>
  29      $msg = $root->appendChild($doc->createElement('Message'));
  30      $msg->appendChild($doc->createTextNode(sprintf(lang($token), $parm)));
  31      
  32      // set status
  33      if ($http_status)
  34          header(sprintf('HTTP/1.1 %s', $http_status));
  35      
  36      // set Content-Type
  37      header('Content-Type: application/xml');
  38  
  39      // display error and halt
  40      die($doc->saveXML()."\n");
  41  }
  42  
  43  // set initial header to 500 in case of error
  44  header('HTTP/1.0 500 Internal Server Error');
  45  
  46  // is the API enabled?
  47  if (!config('api_enable'))
  48      error(99, '', '403 Forbidden');
  49  
  50  // version=, key=, and resource= are required parameters
  51  if (!isset($_REQUEST['v']))
  52      error(101);
  53  if ($_REQUEST['v'] != API_VERSION)
  54      error(102, $_REQUEST['v']);
  55  
  56  // API key
  57  if (config('api_key_required',TRUE)||(strtolower($_SERVER['REQUEST_METHOD'])!='get'))
  58  {
  59      if (!isset($_REQUEST['key']))
  60          error(103);
  61      $user = new User;
  62      $q = sprintf("SELECT * FROM %s WHERE user_hash='%s'", 
  63              $user->table_name(),
  64              addslashes($_REQUEST['key']));
  65      check_db();
  66      $r = $DB->query($q);
  67      $arr = $r->fetch_assoc();
  68      $user = new User(0, $arr);
  69      if ((!$user->id()) || (!$user->is_valid()))
  70          error(104, $_REQUEST['key']);
  71      // need to track the uses of the key and disallow if over api_default_limit
  72  }
  73  
  74  // validate resource
  75  if (!isset($_REQUEST['r']))
  76      error(105);
  77  $class = $_REQUEST['r'];
  78  
  79  // do we have an id= parameter?
  80  if (isset($_REQUEST['id']))
  81  {
  82      $obj = new $class($_REQUEST['id']);
  83      if (!$obj->id())
  84          error(106, $_REQUEST['id'], '404 Not Found');
  85  }
  86  else
  87      $obj = new $class();
  88      
  89  // validate request method
  90  $body = ''; // this is the output
  91  switch(strtolower($_SERVER['REQUEST_METHOD']))
  92  {
  93  case 'delete':
  94      if (!isset($_REQUEST['id']))
  95          error(109, '', '400 Bad Request');
  96      $obj->delete();
  97      if ($obj->is_valid())
  98          header('HTTP/1.1 200 OK');
  99      else
 100          error(111, $obj->get_errors());
 101      break;
 102  
 103  case 'get':
 104      //if (!isset($_REQUEST['id']))
 105      //    error(107, '', '400 Bad Request');
 106      $body = $obj->xml();
 107      header('HTTP/1.1 200 OK');
 108      break;
 109  
 110  case 'post':
 111      $obj->set_post($_POST, $_FILES);
 112      if (isset($_REQUEST['id']))     // if set, we're doing an update
 113      {
 114          $obj->update();
 115          if ($obj->is_valid())
 116          {
 117              header('HTTP/1.1 200 OK');
 118              $body = $obj->xml();
 119          }
 120          else
 121              error(110, $obj->get_errors());
 122      }
 123      else                            // otherwise, we're adding the object
 124      {
 125          $obj->add();
 126          if ($obj->is_valid())
 127          {
 128              header('HTTP/1.1 200 OK');
 129              header('Location: '.config('site_url_base').$obj->get_url());
 130              exit;
 131          }
 132          else
 133              error(110, $obj->get_errors());
 134      }
 135      break;
 136  
 137  default:
 138      header('HTTP/1.1 400 Bad Request');
 139  }
 140  
 141  if (isset($_REQUEST['rd']))
 142      header('Location: '.$_REQUEST['rd']);
 143  else
 144  {
 145      // set Content-Type
 146      header('Content-Type: application/xml');
 147      // return the XML
 148      echo $body;
 149  }
 150  ?>