WordPress.org
Get WordPress

Plugin Directory

Changeset 2811049


Ignore:
Timestamp:
11/03/2022 01:08:13 PM (3 years ago)
Author:
yashyadav247
Message:

release for 2.4.1

Location:
wp-rest-api-authentication
Files:
167 added
11 edited

Legend:

Unmodified
Added
Removed

  • wp-rest-api-authentication/trunk/README.txt

    r2761360 r2811049  
    33Tags: api, rest-api, jwt auth, basic auth, jwt, REST, secure api, token, endpoints, json web token, oauth, api key auth
    44Requires at least: 3.0.1
    5 Tested up to: 6.0
    6 Stable tag: 2.4.0
     5Tested up to: 6.1
     6Stable tag: 2.4.1
    77Requires PHP: 5.6
    88License: MIT/Expat
    … …  
    1313
    1414== Description ==
    15 **Wordpress REST APIs** by default are **loose endpoints** through which a hacker can control your site remotely. You don’t want hackers to give access to your WordPress Login and Wordpress Register or any other endpoints. With our **[WordPress REST API Authentication plugin](https://plugins.miniorange.com/wordpress-rest-api-authentication)**, we promise to have the secure api from unauthorized users and **protects WP REST API endpoints** from public access using [API Key Authentication](https://plugins.miniorange.com/rest-api-key-authentication-method) or [JWT Authentication](https://plugins.miniorange.com/wordpress-rest-api-jwt-authentication-method) or [Basic Authentication](https://plugins.miniorange.com/wordpress-rest-api-basic-authentication-method) or [OAuth 2.0 Authentication](https://plugins.miniorange.com/wordpress-rest-api-oauth-2-0-authentication-method) or third-party OAuth 2.0/OIDC/[Firebase](https://firebase.google.com/docs/auth/admin/create-custom-tokens) provider's token authentication methods. Our plugin is made in a way to make sure that we always have a secure api connection so that data isn’t compromised. JWT Authentication is an industry-approved method to secure communication between 2 parties and we also allow you to use that on your wordpress website.
     15**Wordpress REST APIs** by default are **loose endpoints** through which a hacker can control your site remotely. You don’t want hackers to give access to your WordPress Login and Wordpress Register or any other endpoints. With our **[WordPress REST API Authentication plugin](https://plugins.miniorange.com/wordpress-rest-api-authentication)**, we promise to have the secure api from unauthorized users and **protects WP REST API endpoints** from public access using [API Key Authentication](https://plugins.miniorange.com/rest-api-key-authentication-method) or [JWT Authentication](https://plugins.miniorange.com/wordpress-rest-api-jwt-authentication-method) or [Basic Authentication](https://plugins.miniorange.com/wordpress-rest-api-basic-authentication-method) or [OAuth 2.0 Authentication](https://plugins.miniorange.com/wordpress-rest-api-oauth-2-0-authentication-method) or third-party OAuth 2.0/OIDC/[Firebase](https://firebase.google.com/docs/auth/admin/create-custom-tokens) provider's token authentication methods. Our plugin is made in a way to make sure that we always have a secure api connection so that data isn’t compromised. JWT Authentication is an industry approved method to secure communication between 2 parties and we also allow you to use that on your wordpress website.
    1616It also allows you to access the WordPress REST APIs using the above-mentioned authentication methods from Android / iOS and desktop applications.
    1717This plugin will make sure that only after the successful authentication, the user is allowed to access your site's resources which adds to our motivation towards secure api. REST API Authentication will make your **WordPress login endpoints secure from unauthorized access.** You can protect api with ease and in a highly secure way using this plugin.
    1818This plugin also provides features for authentication of custom-developed REST endpoints and third-party plugin REST API endpoints like that of [Woocommerce](https://wordpress.org/plugins/woocommerce/), [Learndash](https://www.learndash.com/), [Buddypress](https://wordpress.org/plugins/buddypress/), [Gravity forms](https://www.gravityforms.com/), [Cocart](https://wordpress.org/plugins/cart-rest-api-for-woocommerce/) etc.
    1919
    20 **_You can create the custom routes/REST endpoints in WordPress with another GUI-based plugin [Custom API for WordPress](https://wordpress.org/plugins/custom-api-for-wp/)_**.
     20**_You can create the custom routes/REST endpoints in WordPress with another GUI based plugin [Custom API for WordPress](https://wordpress.org/plugins/custom-api-for-wp/)_**.
    2121
    2222You will be able to securely login into the rest api using the following endpoint:
    … …  
    3535* _jwt token (JSON Web tokens) from other Identity Providers (OAuth/OIDC providers)Authenticate/Protect/Secure WordPress REST API endpoints with the access token ._
    3636* _Securely Login and register into Mobile or other client applications using REST APIs._
    37 * _Obtain **user-based JWT token** to use as an authentication source to login and register on other platforms._
     37* _Obtain **user based JWT token** to use as an authentication source to login and register on other platforms._
    3838* _Authenticate Woocommerce REST API endpoints by bypassing WooCommerce consumers' credentials security and instead of using their authentication methods to control the data access and thus improving security and removing chances for exposing the WC credentials._
    3939* _**Authenticate/secure WordPress REST APIs** access using Firebase JWT token, any external JWT token, any OAuth 2.0/OpenID Connect(OIDC) provider access/id-token like Azure AD, Azure B2C, Okta, Keycloak, ADFS, AWS Cognito etc or that provided by Social login providers like Google, Facebook, Apple.
    4040The plugin provides an interface for applications to interact with your WordPress REST API endpoints by sending and receiving data as JSON (JavaScript Object Notation) objects. Also, It provides a user-friendly user interface of the plugin to configure the methods and implement them very easily. You can easily secure api/protect your WordPress REST API endpoints with ease._
    41 * _**API Authentication based on HTTP method (GET/POST/PUT/DELETE)** - This feature provides the facility to choose which APIs need to be restricted and which specific HTTP methods. For example - If you want to allow users to access HTTP GET API of wp/v2/users endpoint to view only the users' list and are not able to use the HTTP POST, PUT, or DELETE to modify them via a REST API request._
    4241 
    4342With our plugin, the user credentials are not stored as cookies but with every API call, user credentials or JWT (JSON Web tokens) or API key are passed so that we have secure api transactions.
    … …  
    6463* This plugin supports interaction with Gravity Forms from an external client application which can be your android/iOS application. WP REST API Authentication also allows WordPress users to create, read, update and delete forms, entries, and results over HTTP based on their roles.
    6564== Learndash API ==
    66 * This plugin allows you to securely access Learndash user profiles, courses, groups & many more third-party APIs.
     65* This plugin allows you to securely access Learndash user profiles, courses, groups & many more third party APIs.
    6766== Custom Built REST API Endpoints ==
    6867* The plugin **supports authentication for your own built custom REST API routes/endpoints**. You can secure these API endpoints using the plugin’s highly secured authentication methods.
    6968== External/Third-party plugin API endpoints integration in WordPress ==
    7069* These integrations can be used to fetch/update the data from the third-party side into the WordPress that can be used to display it on the WordPress site as well as this data can be processed further to use with any other plugin or WordPress events.
    71 == Authentication for API access securely in Headless WordPress ==
    72 * Using this plugin, you can access your WordPress REST API endpoints securely on your Headless WordPress having the front end built via Angular, React, Node JS, Vue etc.
    73 
    74 
     70 
    7571== FEATURES ==
    7672 
    … …  
    131127   
    132128= How to enable API access in WooCommerce?
    133     You can enable API access in WooCommerce using our WP REST API Authentication plugin. Please reach out to us at api[email protected].
     129    You can enable API access in WooCommerce using our WP REST API Authentication plugin. Please reach out to us at oauth[email protected].
    134130
    135131= How does the REST API Authentication plugin work? =
    … …  
    142138    To access the pages/posts stored in the draft, you need to append the ?status=draft to the page/post request.
    143139    For Example:
    144     You need to use below URL format while sending a request to access different types of posts
     140    You need to use below URL format while sending request to access different type of posts
    145141    1. Access draft posts only
    146142        https://<domain>/wp-json/wp/v2/posts?status=draft
    147     2. Access all types of posts
     143    2. Access all type of posts
    148144        https://<domain>/wp-json/wp/v2/posts?status=any
    149     You just have to change the status(draft, pending, any, publish) as per your requirement. You do not have to pass the status parameter to access Published posts.
     145    You just have to change the status(draft, pending, any, publish) as per your requirement. You do not have to pass status parameter to access Published posts.
    150146
    151147= How can I authenticate the REST APIs using this plugin? =
    … …  
    174170    This plugin provides this HTTP POST endpoint `wp-json/api/v1/token` also called as WordPress login API endpoint in which you can pass the user's WordPress credentials and this endpoint will validate the user and returns you with the appropriate response.
    175171    The plugin also supports the authentication and authorization of WordPress users' register REST API.
    176 
    177 = Does this plugin provides accessing API securely in headless WordPress? =
    178     Yes, using this plugin, you can authenticate the WordPress REST API requests made from the front end of the Headless WordPress (Headless WP) built using Angular JS, React JS, Node JS, Vue JS, Flutter etc.
    179172   
    180173
    … …  
    191184== Changelog ==
    192185
    193 = 2.4.0 =
    194 * Password validation enhancement for JWT authentication
    195 * Minor UI fixes
     186= 2.4.1 =
     187* WordPress 6.1 compatibility
     188* Added the endpoint to check the JWT token for JWT authentication method.
    196189
    197190= 2.3.0 =
    … …  
    218211
    219212= 1.6.7 =
    220 * Compatibility with WordPress 5.9
     213* Compatiblity with WordPress 5.9
    221214
    222215= 1.6.6 =
    … …  
    224217
    225218= 1.6.5 =
    226 * WordPress 5.8.2 compatibility
     219* WordPress 5.8.2 compatiblity
    227220* UI Changes
    228221
    … …  
    231224
    232225= 1.6.3 =
    233 * WordPress 5.8.1 compatibility
     226* WordsPress 5.8.1 compatability
    234227* Readme Updates
    235228
    236229= 1.6.2 =
    237 * WordPress 5.8 compatibility
     230* WordPress 5.8 compatiblity
    238231* Bug Fixes
    239232* Usability Improvements
    … …  
    304297* Added UI Changes
    305298* Updated plugin licensing
    306 * Added new features
     299* Added New features
    307300* Added compatibility for WP 5.3 & PHP7.4
    308301* Minor UI & feature fixes

  • wp-rest-api-authentication/trunk/admin/class-miniorange-api-authentication-admin.php

    r2761358 r2811049  
    232232        self::convergence();
    233233    }
    234 
    235 
    236     public function mo_api_auth_initialize_api_flow() {
     234   
     235    public function register_rest_routes(){
     236        register_rest_route('api/v1','token-validate',array('methods' => 'GET',
     237                                                            'callback'=> array( $this, 'mo_rest_JWT_validate_token' ),
     238                                                            'permission_callback' => '__return_true',
     239                                                            ));
     240        register_rest_route('api/v1','token',array('methods' => 'POST',
     241                                                    'callback'=> array($this,'mo_rest_token_generation_callback'),
     242                                                    'permission_callback' => '__return_true'
     243                                                    ));
     244       
     245    }
     246
     247    public function mo_rest_api() {
     248        return apply_filters( 'jwt_auth_alg', 'HS256' );
     249    }
     250
     251    public function  mo_rest_token_generation_callback($request_body){
     252                $json=$request_body->get_params();
     253                $json=array('username'=>$json['username'],'password'=>$json['password']);
     254                mo_api_auth_token_endpoint_flow($json);
     255       
     256    }
     257
     258    public function mo_api_auth_initialize_api_flow(){
     259                mo_api_auth_restrict_rest_api_for_invalid_users();
     260            }
     261
     262    public function mo_rest_JWT_validate_token( $return_response = true ) {
     263        $headerkey = mo_api_auth_getallheaders();
     264        $headerkey = array_change_key_case($headerkey, CASE_UPPER);
     265        $response  = Mo_API_Authentication_JWT_Auth::mo_api_auth_is_valid_request($headerkey);
     266        if($response === true)
     267        {
     268            $response= ["status"=> "TRUE",
     269            "message"=> "VALID_TOKEN",
     270            "code"=> "200"];
     271               
     272                }
     273        if($response === false)
     274        {
     275           
     276            $response= ['status' => "error",
     277            'error' => 'UNAUTHORIZED',
     278            'code'  => '401',
     279            'error_description' => 'Incorrect JWT Format.'];
     280               
     281                }
     282         wp_send_json($response);
     283    }
     284
     285
     286    public function mo_api_auth_initialize_api_flow_old() {
    237287       
    238288        if(!empty($_GET['mo_rest_api_test_config'])) {
    … …  
    250300       
    251301        else{
    252            
    253             if ( !mo_api_auth_user_has_capability() && (strpos(sanitize_text_field($_SERVER['REQUEST_URI']), 'moserver') === false) ) {
     302            if ( !mo_api_auth_user_has_capability()) {
    254303                if(strpos(sanitize_text_field($_SERVER['REQUEST_URI']), '/api/v1/token') !== false  && get_option( 'mo_api_authentication_selected_authentication_method' ) === 'jwt_auth' ) {
    255304                    $json = file_get_contents('php://input');
    256305                    $json = json_decode( $json, true );
    257306                    if( json_last_error() !== JSON_ERROR_NONE ) {
    258                         $json = array_map( 'esc_attr', $_POST );
     307                        $json = array_map( 'sanitize_text_field', $_POST );
    259308                    }
    260309                    mo_api_auth_token_endpoint_flow($json);
    … …  
    266315    }
    267316
    268 
    269     function regenerate_token() {   
    270         if (sanitize_text_field($_SERVER['REQUEST_METHOD']) === 'POST' &&  current_user_can('administrator') ) {
    271             $bearer_token = stripslashes( wp_generate_password( 32, false, false ) );
    272             update_option( 'mo_api_auth_bearer_token ', $bearer_token );
    273             echo esc_attr( $bearer_token );
    274             wp_die();
    275         }
    276     }
    277 
    278     function regenerate_client_credentials(){
    279         if (sanitize_text_field($_SERVER['REQUEST_METHOD']) === 'POST' &&  current_user_can('administrator') ) {
    280             mo_api_authentication_create_client();
    281             $response = [
    282                 'client_id' => get_option( 'mo_api_auth_clientid' ),
    283                 'client_secret' => get_option( 'mo_api_auth_clientsecret' )
    284             ];
    285             wp_send_json( $response, 200 );
    286         }
    287     }
    288 
    289317    function save_temporary_data(){
    290318       
    291         if (sanitize_text_field($_SERVER['REQUEST_METHOD']) === 'POST' &&  current_user_can('administrator') ) {
     319        if (sanitize_text_field($_SERVER['REQUEST_METHOD']) === 'POST' &&  current_user_can('administrator') && wp_verify_nonce($_SERVER['nonce'] , 'mo_rest_api_temporal_data_nonce' ) ) {
    292320            if(isset($_POST['auth_method']) && sanitize_text_field($_POST['auth_method']) == 'basic_auth'){
    293321

  • wp-rest-api-authentication/trunk/admin/css/miniorange-api-authentication-admin.css

    r2720707 r2811049  
    11081108}
    11091109
    1110 
     1110.mo_oauth_rest_trobleshoot{
     1111    width: 1.3em;
     1112    height: 1.3em;
     1113    display: block;
     1114    margin-bottom:-20px;
     1115}
    11111116
    11121117.mo_test_config_string { color: white;  }

  • wp-rest-api-authentication/trunk/admin/partials/advanced/class-mo-api-authentication-protectedrestapis.php

    r2761358 r2811049  
    104104
    105105        public static function checkRouteIsWPStandardOrNot( $route ) {
    106 
    107106            if (stripos($route, '/wp/v2') === false){
    108107                return false;

  • wp-rest-api-authentication/trunk/admin/partials/config/output/class-mo-api-authentication-basic-oauth-config.php

    r2761358 r2811049  
    214214                        <tr>
    215215                            <td>
    216                                 <br><br><input type='button' onclick="test_config_basic_auth();" value="Test Configuration" class="mo_test_config_button"></button>
     216                                <br><br><input type='button' onclick="mo_rest_api_JWTtest_config_basic_auth();" value="Test Configuration" class="mo_test_config_button"></button>
    217217                            </td>
    218218                        </tr>
    … …  
    225225                    <h4 id='basic_auth_response_text' style='display:none;'><b> Response: </b></h4>
    226226                    <pre id="json_basic_auth" class = 'mo_test_config_response'></pre>
     227                    <h4 id='basic_display_text' style='display:none;'><img class="mo_oauth_rest_trobleshoot" src="<?php echo esc_url(dirname( plugin_dir_url( __FILE__ ) ));?>/images/trouble_2.png"><b style="margin-left:25px;"> TroubleShoot </b></h4>
     228                    <pre style='padding: 15px 10px 15px 25px;' id="basic_display_troubleshoot" class='mo_test_config_response'>
     229                    </pre>
    227230                    <br>   
    228231                    <br>
    … …  
    244247                    'auth_method' : 'basic_auth',
    245248                    'algo' : 'base64',
    246                     'token_type' : localStorage.getItem('mo_api_basic_token_type')
     249                    'token_type' : localStorage.getItem('mo_api_basic_token_type'),
     250                    'nonce': '<?php echo wp_create_nonce( 'mo_rest_api_temporal_data_nonce' ); ?>'
    247251                };         
    248252
    … …  
    296300            }
    297301
    298             function test_config_basic_auth() {
     302            function mo_rest_api_JWTtest_config_basic_auth() {
    299303                var username = document.getElementById("rest_basic_auth_username").value;
    300304                var password = document.getElementById("rest_basic_auth_password").value;
    … …  
    321325                fetch(endpoint, requestOptions)
    322326                .then(response => response.text())
    323                 .then(result => display_basic_auth_data(result))
     327                .then(result => mo_rest_api_display_basic_auth_data(result))
    324328                .catch(error => console.log('error', error));
    325329            }
    326330
    327             function output_basic_auth(inp) {
     331            function mo_rest_api_output_basic_auth(inp) {
    328332                document.getElementById("json_basic_auth").innerHTML = inp;
    329333            }
    330334
    331             function syntaxHighlight_basic_auth(json) {
     335            function mo_rest_api_syntaxHighlight_basic_auth(json) {
    332336                json = json.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
    333337                return json.replace(/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?)/g, function (match) {
    … …  
    349353            }
    350354
    351             function display_basic_auth_data(result) {
     355            function mo_rest_api_display_basic_auth_data(result) {
    352356                // console.log(result);
    353357                var data = JSON.parse(result);
    354358                var json = JSON.stringify(data, undefined, 4);
    355                 output_basic_auth(syntaxHighlight_basic_auth(json));
     359                mo_rest_api_output_basic_auth(mo_rest_api_syntaxHighlight_basic_auth(json));
    356360                document.getElementById("json_basic_auth").style.display = "block";
    357361                document.getElementById("basic_auth_request_headers").style.display = "block";
    … …  
    359363                document.getElementById("basic_auth_response_text").style.display = "block";
    360364                document.getElementById("basic_auth_response_text").scrollIntoView({behavior: 'smooth' });
    361             }
     365                if(data.error)
     366                        mo_rest_api_troubleshootPrintBasic(data.error);
     367                    else
     368                        mo_rest_api_troubleshootHideBasic();
     369            }
     370            function mo_rest_api_troubleshootHideBasic(){
     371               
     372                        document.getElementById("basic_display_troubleshoot").style.display = "none";
     373                        document.getElementById("basic_display_text").style.display = "none";
     374            }
     375            function mo_rest_api_troubleshootPrintBasic(err){
     376                if(err === "INVALID_PASSWORD")
     377                    {
     378                        document.getElementById("basic_display_troubleshoot").innerHTML = `<ul style="list-style: inside;"><li>Check if username and password entered are correct.</li><li>If yes try password without special charachters.</li></ul>`;
     379                        document.getElementById("basic_display_troubleshoot").style.display = "block";
     380                        document.getElementById("basic_display_text").style.display = "inline-block";
     381                       
     382                    }
     383                    else if(err  === "INVALID_USERNAME")
     384                    {
     385                        document.getElementById("basic_display_troubleshoot").innerHTML = '<ul style="list-style: inside;"><li>Check if user with this username exists.</li><li>Check if username entered is correct.</li></ul>';
     386                        document.getElementById("basic_display_troubleshoot").style.display = "block";
     387                        document.getElementById("basic_display_text").style.display = "inline-block";
     388                       
     389                    }
     390                    else if(err === "INVALID_CLIENT_CREDENTIALS")
     391                    {
     392                        document.getElementById("basic_display_troubleshoot").innerHTML = 'INVALID_CLIENT_CREDENTIALS';
     393                        document.getElementById("basic_display_troubleshoot").style.display = "block";
     394                        document.getElementById("basic_display_text").style.display = "inline-block";
     395                       
     396                    }
     397                    else if(err === "MISSING_AUTHORIZATION_HEADER")
     398                    {
     399                        document.getElementById("basic_display_troubleshoot").innerHTML = 'MISSING_AUTHORIZATION_HEADER';
     400                        document.getElementById("basic_display_troubleshoot").style.display = "block";
     401                        document.getElementById("basic_display_text").style.display = "inline-block";
     402                       
     403                    }
     404                    else if(err === "INVALID_AUTHORIZATION_HEADER_TOKEN_TYPE")
     405                    {
     406                        document.getElementById("basic_display_troubleshoot").innerHTML = 'INVALID_AUTHORIZATION_HEADER_TOKEN_TYPE';
     407                        document.getElementById("basic_display_troubleshoot").style.display = "block";
     408                        document.getElementById("basic_display_text").style.display = "inline-block";
     409                       
     410                    }
     411                    else if(err === "INVALID_TOKEN_FORMAT")
     412                    {
     413                        document.getElementById("basic_display_troubleshoot").innerHTML = 'INVALID_TOKEN_FORMAT';
     414                        document.getElementById("basic_display_troubleshoot").style.display = "block";
     415                        document.getElementById("basic_display_text").style.display = "inline-block";
     416                       
     417                    }
     418
     419                       
     420                    }
    362421
    363422        </script>

  • wp-rest-api-authentication/trunk/admin/partials/config/output/class-mo-api-authentication-jwt-auth-config.php

    r2761358 r2811049  
    144144                        </tr>
    145145                        <tr>
    146                             <td><input type='button' value="POST" class='mo_test_config_request_method'>&nbsp;<input type='text' id='rest_token_endpoint' value="<?php echo esc_html(get_rest_url())."api/v1/token"; ?>" readonly class='mo_test_config_input'></td>
    147                         </tr>
    148                         <tr>
    149                             <td>
    150                                 <br><input type='button' onclick="test_config('token');" value="Fetch Token" class="mo_test_config_button"></button>
     146                            <td><input type='button' value="POST" class='mo_test_config_request_method'>&nbsp;<input type='text' id='rest_token_endpoint' value="<?php echo esc_url(get_rest_url()."api/v1/token"); ?>" readonly class='mo_test_config_input'></td>
     147                        </tr>
     148                        <tr>
     149                            <td>
     150                                <br><input type='button' onclick="mo_JWT_test_config('token');" value="Fetch Token" class="mo_test_config_button"></button>
    151151                            </td>
    152152                        </tr>
    … …  
    156156                    <pre id="json_jwt_token" class='mo_test_config_response'>
    157157                    </pre>
     158                    <h4 id='jwt_token_troubleshoot_text' style='display:none;'><img class="mo_oauth_rest_trobleshoot" src="<?php echo esc_url(dirname( plugin_dir_url( __FILE__ ) ));?>/images/trouble_2.png"><b style="margin-left:25px;"> TroubleShoot </b></h4>
     159                    <pre style='padding: 15px 10px 15px 25px;' id="json_jwt_token_troubleshoot" class='mo_test_config_response'>
     160                   
     161                    </pre>
     162                   
     163                    <table width="80%">
     164                        <tr>
     165                            <td>
     166                                <p style='color:#2a2ea9; font-size: 1.1em;'><b>[2] Check if token is valid: </b></p>
     167                            </td>
     168                        </tr>
     169                        <tr>
     170                            <td>
     171                                <p>Token:</p>
     172                                <input type="text" id='rest_token_value' size="28" placeholder="Enter JWT Token"  class='mo_test_config_input'>
     173                            </td>
     174                        </tr>
     175                        <tr>
     176                            <td>
     177                                <p>Token Validation Endpoint: </p>
     178                            </td>
     179                        </tr>
     180                        <tr>
     181                        <td><input type='button' value="GET" class='mo_test_config_request_method'>&nbsp;<input type='text' id='rest_validate_endpoint' value="<?php echo esc_url(get_rest_url()."api/v1/token-validate"); ?>" readonly class='mo_test_config_input'></td>
     182                        </tr>
     183                        <tr>
     184                            <td>
     185                                <br><input type='button' onclick="mo_JWT_test_config('validate');" value="Check Token" class="mo_test_config_button"></button>
     186                            </td>
     187                        </tr>
     188                    </table>
     189                    <br>   
     190                    <h4 id='jwt_token_validate_response_text' style='display:none;'><b> Response: </b></h4>
     191                    <pre id="json_jwt_token_validate" class='mo_test_config_response'>
     192                    </pre>
     193                    <h4 id='jwt_token_validate_text' style='display:none;'><img class="mo_oauth_rest_trobleshoot" src="<?php echo esc_url(dirname( plugin_dir_url( __FILE__ ) ));?>/images/trouble_2.png"><b style="margin-left:25px;"> TroubleShoot </b></h4>
     194                    <pre style='padding: 15px 10px 15px 25px;' id="json_jwt_token_validate_troubleshoot" class='mo_test_config_response'>
     195                   
     196                    </pre>
     197
     198
    158199                    <table>
    159200                        <tr>
    160201                            <td>
    161                                 <p style='color: #2a2ea9; font-size: 1.1em;'><b>[2] Access the protected REST APIs by using the jwt_token obtained from above Step[1]: </b></p>
     202                                <p style='color: #2a2ea9; font-size: 1.1em;'><b>[3] Access the protected REST APIs by using the jwt_token obtained from above Step[1]: </b></p>
    162203                            </td>
    163204                        </tr>
    … …  
    179220                        <tr>
    180221                            <td>
    181                                 <br><input type='button' onclick="test_config('rest');" value="Test Configuration" class="mo_test_config_button" />
     222                                <br><input type='button' onclick="mo_JWT_test_config('rest');" value="Test Configuration" class="mo_test_config_button" />
    182223                            </td>
    183224                        </tr>
    … …  
    190231                    <h4 id='jwt_token_api_response_text' style='display:none;'><b>Response: </b></h4>
    191232                    <pre id="json_jwt" class='mo_test_config_response'>
     233                    </pre>
     234                    <h4 id='data_display_text' style='display:none;'><img class="mo_oauth_rest_trobleshoot" src="<?php echo esc_url(dirname( plugin_dir_url( __FILE__ ) ));?>/images/trouble_2.png"><b style="margin-left:25px;"> TroubleShoot </b></h4>
     235                    <pre style='padding: 15px 10px 15px 25px;' id="data_display_troubleshoot" class='mo_test_config_response'>
     236                   
    192237                    </pre>
    193238                    <!-- <div id="json_jwt" style='display:none;'> -->
    … …  
    203248                var token_endpoint_obj = document.getElementById('rest_token_endpoint');
    204249                token_endpoint_obj.style.width = ((token_endpoint_obj.value.length + 1) * 7) + 'px';
     250                var token_endpoint_obj = document.getElementById('rest_validate_endpoint');
     251                token_endpoint_obj.style.width = ((token_endpoint_obj.value.length + 1) * 7) + 'px';
    205252                var token_endpoint_obj = document.getElementById('rest_endpoint_jwt_auth');
    206253                token_endpoint_obj.style.width = ((token_endpoint_obj.value.length + 1) * 7) + 'px';
    … …  
    227274
    228275
    229                 function test_config(event) {
     276                function mo_JWT_test_config(event) {
    230277                    if(event === 'token') {
    231278                        var token_endpoint = document.getElementById("rest_token_endpoint").value;
    … …  
    247294                        };
    248295
    249                         token_endpoint = token_endpoint + "?mo_rest_api_test_config=jwt_auth"
     296                   
    250297
    251298                        fetch(token_endpoint, requestOptions)
    252299                        .then(response => response.text())
    253                         .then(result => display_jwt_data(result))
     300                        .then(result => moJWTdisplay_jwt_data(result))
    254301                        .catch(error => console.log('error', error));
    255302                    }
    256                     else {
    257                         var token = document.getElementById("rest_jwt_token").value;
    258                         var endpoint = document.getElementById("rest_endpoint_jwt_auth").value;
     303                    else if(event === "validate"){
     304                        var validate_endpoint = document.getElementById("rest_validate_endpoint").value;
     305                        var token_val = document.getElementById("rest_token_value").value;
     306
     307                       
    259308
    260309                        var myHeaders = new Headers();
    261 
    262                         myHeaders.append("Authorization", "Bearer "+token);
    263                         document.getElementById("jwt_request_headers_value").textContent = token;
     310                        myHeaders.append('Content-Type', 'application/json');
     311                        myHeaders.append('Authorization','Bearer '+ token_val);
    264312
    265313                        var requestOptions = {
    … …  
    268316                            redirect: 'follow'
    269317                        };
    270 
    271                         endpoint = endpoint + "?mo_rest_api_test_config=jwt_auth"
     318                        validate_endpoint=validate_endpoint+ "?mo_rest_api_test_config=jwt_auth";
     319
     320                        fetch(validate_endpoint, requestOptions)
     321                        .then(response => response.text())
     322                        .then(result => moJWTdisplay_token_val_data(result))
     323                        .catch(error => console.log('error', error));
     324
     325                    }
     326                    else {
     327                        var token = document.getElementById("rest_jwt_token").value;
     328                        var endpoint = document.getElementById("rest_endpoint_jwt_auth").value;
     329
     330                        var myHeaders = new Headers();
     331
     332                        myHeaders.append("Authorization", "Bearer "+token);
     333                        document.getElementById("jwt_request_headers_value").textContent = token;
     334
     335                        var requestOptions = {
     336                            method: 'GET',
     337                            headers: myHeaders,
     338                            redirect: 'follow'
     339                        };
     340
     341                        endpoint = endpoint + "?mo_rest_api_test_config=jwt_auth";
    272342
    273343                        fetch(endpoint, requestOptions)
    274344                        .then(response => response.text())
    275                         .then(result => display_data(result))
     345                        .then(result => moJWTdisplay_data(result))
    276346                        .catch(error => console.log('error', error));
    277347                    }
    278348                }
    279349
    280                 function display_jwt_data(result) {
    281                     // console.log(result);
     350                function moJWTdisplay_jwt_data(result) {
    282351                    var data = JSON.parse(result);
    283352                    var json = JSON.stringify(data, undefined, 4);
    284                     output(syntaxHighlight(json), 'token');
     353                    moJWToutput(moJWTsyntaxHighlight(json), 'token');
    285354                    document.getElementById("json_jwt_token").style.display = "block";
    286355                    document.getElementById("jwt_token_response_text").style.display = "block";
    287356                    document.getElementById("jwt_token_response_text").scrollIntoView({behavior: 'smooth' });
    288                 }
    289 
    290                 function output(inp, endpoint) {
     357                    if(data.error)
     358                        moJWTtroubleshootPrintJWT(data.error , 'token');
     359                    else
     360                        moJWTtroubleshootHideJWT('token');
     361                }
     362                function moJWTdisplay_token_val_data(result) {
     363                    var data = JSON.parse(result);
     364                    var json = JSON.stringify(data, undefined, 4);
     365                    moJWToutput(moJWTsyntaxHighlight(json), 'validate');
     366                    document.getElementById("json_jwt_token_validate").style.display = "block";
     367                    document.getElementById("jwt_token_validate_response_text").style.display = "block";
     368                    document.getElementById("jwt_token_validate_response_text").scrollIntoView({behavior: 'smooth' });
     369                    if(data.error)
     370                        moJWTtroubleshootPrintJWT(data.error , 'valid');
     371                    else
     372                        moJWTtroubleshootHideJWT('valid');
     373                }
     374                function moJWTtroubleshootHideJWT(place){
     375                    if(place === "token"){
     376                        document.getElementById("json_jwt_token_troubleshoot").style.display = "none";
     377                        document.getElementById("jwt_token_troubleshoot_text").style.display = "none";
     378                    }
     379                    else if(place === "valid"){
     380                        document.getElementById("json_jwt_token_validate_troubleshoot").style.display = "none";
     381                        document.getElementById("jwt_token_validate_text").style.display = "none";
     382                    }
     383                    else{
     384                        document.getElementById("data_display_troubleshoot").style.display = "none";
     385                        document.getElementById("data_display_text").style.display = "none";
     386                    }
     387                   
     388                   
     389                   
     390                }
     391                function moJWTtroubleshootPrintJWT(err,place){
     392                    if(err === "INVALID_CREDENTIALS")
     393                    {
     394                        document.getElementById("json_jwt_token_troubleshoot").innerHTML = `<ul style="list-style: inside;"><li>Check if username and password entered are correct.</li><li>If yes try password without special charachters.</li></ul>`;
     395                        document.getElementById("json_jwt_token_troubleshoot").style.display = "block";
     396                        document.getElementById("jwt_token_troubleshoot_text").style.display = "inline-block";
     397                       
     398                    }
     399                    else if(err === "BAD_REQUEST")
     400                    {
     401                        document.getElementById("json_jwt_token_troubleshoot").innerHTML = 'Username or Password is missing.';
     402                        document.getElementById("json_jwt_token_troubleshoot").style.display = "block";
     403                        document.getElementById("jwt_token_troubleshoot_text").style.display = "inline-block";
     404                       
     405                    }
     406                    else if(err === "SEGMENT_FAULT")
     407                    {
     408                        if(place === "valid"){
     409                            document.getElementById("json_jwt_token_validate_troubleshoot").innerHTML = 'JWT token you entered is of invalid format re-enter it properly.';
     410                            document.getElementById("json_jwt_token_validate_troubleshoot").style.display = "block";
     411                            document.getElementById("jwt_token_validate_text").style.display = "block";
     412                            }
     413                        else{
     414                            document.getElementById("data_display_troubleshoot").innerHTML = 'JWT token you entered is of invalid format re-enter it properly.';
     415                            document.getElementById("data_display_troubleshoot").style.display = "block";
     416                            document.getElementById("data_display_text").style.display = "block";
     417                            }
     418                    }
     419                    else if(err === "INVALID_PASSWORD")
     420                    {
     421                        document.getElementById("json_jwt_token_validate_troubleshoot").innerHTML = '';
     422                        document.getElementById("json_jwt_token_validate_troubleshoot").style.display = "block";
     423                        document.getElementById("jwt_token_validate_text").style.display = "block";
     424                       
     425                    }
     426                    else if(err === "MISSING_AUTHORIZATION_HEADER")
     427                    {
     428                       
     429                        if(place === "valid"){
     430                            document.getElementById("json_jwt_token_validate_troubleshoot").innerHTML = 'JWT token field is empty.';
     431                            document.getElementById("json_jwt_token_validate_troubleshoot").style.display = "block";
     432                            document.getElementById("jwt_token_validate_text").style.display = "block";
     433                           
     434                        }
     435                        else{
     436                            document.getElementById("data_display_troubleshoot").innerHTML = 'JWT token field is empty.';
     437                            document.getElementById("data_display_troubleshoot").style.display = "block";
     438                            document.getElementById("data_display_text").style.display = "block";
     439                           
     440                        }
     441                    }
     442                    else if(err === "INVALID_AUTHORIZATION_HEADER_TOKEN_TYPE")
     443                    {
     444                        if(place === "valid"){
     445                            document.getElementById("json_jwt_token_validate_troubleshoot").innerHTML = 'JWT token is missing check the JWT token field.';
     446                            document.getElementById("json_jwt_token_validate_troubleshoot").style.display = "block";
     447                            document.getElementById("jwt_token_validate_text").style.display = "block";
     448                           
     449                        }
     450                        else{
     451                            document.getElementById("data_display_troubleshoot").innerHTML = 'JWT token is missing check the JWT token field.';
     452                            document.getElementById("data_display_troubleshoot").style.display = "block";
     453                            document.getElementById("data_display_text").style.display = "block";
     454                           
     455                        }
     456                    }
     457                    else if(err === "UNAUTHORIZED")
     458                    {
     459                        if(place === "valid"){
     460                            document.getElementById("json_jwt_token_validate_troubleshoot").innerHTML = `<ul style="list-style: inside;"><li>JWT token entered is either expired or is of different authorization flow.</li><li>Regenrate JWT token and copy past it properly.</li></ul>`;
     461                            document.getElementById("json_jwt_token_validate_troubleshoot").style.display = "block";
     462                            document.getElementById("jwt_token_validate_text").style.display = "block";
     463                           
     464                        }
     465                        else{
     466                            document.getElementById("data_display_troubleshoot").innerHTML = `<ul style="list-style: inside;"><li>JWT token entered is either expired or is of different authorization flow.</li><li>Regenrate JWT token and copy past it properly.</li></ul>`;
     467                            document.getElementById("data_display_troubleshoot").style.display = "block";
     468                            document.getElementById("data_display_text").style.display = "block";
     469                           
     470                        }
     471                    }
     472                   
     473                   
     474                }
     475               
     476
     477                function moJWToutput(inp, endpoint) {
    291478                    // document.body.appendChild(document.createElement('pre')).innerHTML = inp;
    292479                    if( endpoint === 'wp_rest_api') {
    293480                        document.getElementById("json_jwt").innerHTML = inp;
    294                     } else {
     481                    }
     482
     483                    else if(endpoint === "token"){
    295484                        document.getElementById("json_jwt_token").innerHTML = inp;
    296485                    }
    297                 }
    298 
    299                 function syntaxHighlight(json) {
     486                    else{
     487                        document.getElementById("json_jwt_token_validate").innerHTML = inp;
     488                    }
     489                }
     490
     491                function moJWTsyntaxHighlight(json) {
    300492                    json = json.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
    301493                    return json.replace(/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?)/g, function (match) {
    … …  
    316508                }
    317509
    318                 function display_data(result) {
    319                     // console.log(result);
     510                function moJWTdisplay_data(result) {
    320511                    var data = JSON.parse(result);
    321512                    var json = JSON.stringify(data, undefined, 4);
    … …  
    325516                    document.getElementById("jwt_token_api_response_text").style.display = "block";
    326517                    document.getElementById("jwt_token_api_response_text").scrollIntoView({behavior: 'smooth' });
    327                     output(syntaxHighlight(json), 'wp_rest_api');
     518                    moJWToutput(moJWTsyntaxHighlight(json), 'wp_rest_api');
     519                    if(data.error)
     520                        moJWTtroubleshootPrintJWT(data.error , 'wp_rest_api');
     521                    else
     522                        moJWTtroubleshootHideJWT('wp_rest_api');
    328523                   
    329524                }

  • wp-rest-api-authentication/trunk/admin/partials/flow/class-mo-api-authentication-basic-oauth.php

    r2761358 r2811049  
    2323                        $user = get_user_by('login', $uname);
    2424                        if( $user ) {
    25                             if(wp_check_password( $pword, $user->user_pass, $user->ID )){
     25                            $valid_pass=wp_authenticate_username_password( NULL,$uname, $pword );
     26                            if(!is_wp_error($valid_pass)){
    2627                                wp_set_current_user($user->ID);
    2728                                return true;

  • wp-rest-api-authentication/trunk/admin/partials/flow/mo-api-authentication-flow.php

    r2761358 r2811049  
    6060
    6161            // Save whitelist to the Options table
     62           
    6263            update_option('mo_api_authentication_protectedrestapi_route_whitelist', $rest_routes);
    6364            add_settings_error('ProtectedRestAPI_notices', 'settings_updated', 'Whitelist settings saved.', 'updated');
    … …  
    8283    $all_routes = array_keys( $wp_rest_server->get_routes() );
    8384    $all_routes = array_map('esc_html',$all_routes);
     85
     86    foreach($all_routes as $key => $value){
     87        if($value === "/api/v1/token"){
     88            array_splice($all_routes,$key,1);
     89        }
     90
     91    }
     92    foreach($all_routes as $key => $value){
     93        if($value === "/api/v1/token-validate"){
     94            array_splice($all_routes,$key,1);
     95        }
     96
     97    }
     98
    8499    update_option( 'mo_api_authentication_protectedrestapi_route_whitelist', $all_routes);
    85100}
    … …  
    156171        }
    157172    }
     173   
     174    $jsonfile=plugin_dir_path(__FILE__);
     175    $jsonfile=rtrim($jsonfile,'/');
     176    $jsonfile=$jsonfile.'\\mo_temp_json_file.json';
     177    file_put_contents($jsonfile, $contents);
     178   
    158179    header('Content-Disposition: attachment; filename ='.$filename);
    159180    header('Content-Type: application/json');
    160181    ob_clean();
    161     echo esc_html($contents);
     182    @readfile($jsonfile);
     183    unlink($jsonfile);
    162184    exit();
    163185}

  • wp-rest-api-authentication/trunk/admin/partials/flow/mo-token-api-flow.php

    r2761358 r2811049  
    1919function mo_api_auth_method_get_token($request) {
    2020    if( isset( $request['username'] ) && isset( $request['password'] ) ) {
    21         $username   = sanitize_text_field( $request['username'] );
    22         $password   = sanitize_text_field( $request['password'] );
     21        $username   =$request['username'];
     22        $password   = $request['password'] ;
     23       
    2324        $client_secret = sanitize_text_field( get_option('mo_api_authentication_jwt_client_secret') );
    2425
    … …  
    3435
    3536        $user = get_user_by('login', $username);
    36 
    3737        if( $user ) {
    3838            wp_set_current_user($user->ID);
    39             $valid_pass = wp_check_password( $password, $user->user_pass, $user->ID );
     39           
     40            $valid_pass = wp_authenticate_username_password( NULL,$username, $password );
     41           
     42            if(is_wp_error($valid_pass)){
     43                $valid_pass=false;
     44            }
     45            else{
     46                $valid_pass=true;
     47            }
    4048        }
    4149
    … …  
    126134{       
    127135
    128         if(is_user_logged_in() && empty(sanitize_text_field($_GET['mo_rest_api_test_config']))){
     136        if( is_user_logged_in() && empty( isset($_GET['mo_rest_api_test_config']) ? sanitize_text_field($_GET['mo_rest_api_test_config']) : ""  ) ){
    129137            return true;
    130138        }
    … …  
    144152    $headers = array_change_key_case($headers, CASE_UPPER);
    145153   
    146     if (stripos(explode('?', sanitize_text_field($_SERVER['REQUEST_URI']), 2)[0], '/wp/v2') === false ){
     154    if (stripos(explode('?', sanitize_text_field($_SERVER['REQUEST_URI']), 2)[0], '/wp/v2') === false){
    147155        if(get_option('mo_rest_api_protect_migrate')){
    148156            $response = array(
    … …  
    174182        }
    175183    }
     184
     185
    176186
    177187    return $response;

  • wp-rest-api-authentication/trunk/includes/class-miniorange-api-authentication.php

    r2761358 r2811049  
    159159        $this->loader->add_action( 'admin_menu', $plugin_admin, 'mo_api_authentication_config_settings');
    160160        $this->loader->add_action( 'admin_menu', $plugin_admin, 'mo_api_auth_admin_menu' );
     161        $this->loader->add_action( 'rest_api_init', $plugin_admin, 'register_rest_routes' );
    161162        $this->loader->add_action( 'rest_api_init', $plugin_admin, 'mo_api_auth_initialize_api_flow' );
    162         $this->loader->add_action( 'wp_ajax_regenerate_token', $plugin_admin, 'regenerate_token' );
    163         $this->loader->add_action( 'wp_ajax_regenerate_client_credentials', $plugin_admin, 'regenerate_client_credentials' );
    164163        $this->loader->add_action( 'wp_ajax_save_temporary_data', $plugin_admin, 'save_temporary_data' );
    165164    }

  • wp-rest-api-authentication/trunk/miniorange-api-authentication.php

    r2761358 r2811049  
    44 * Plugin URI:        wp-rest-api-authentication
    55 * Description:       WordPress REST API Authentication secures rest API access for unauthorized users using OAuth 2.0, Basic Auth, JWT, API Key. Also reduces potential attack factors to the respective site.
    6  * Version:           2.4.0
     6 * Version:           2.3.1
    77 * Author:            miniOrange
    88 * Author URI:        https://www.miniorange.com
    … …  
    2121 * Rename this for your plugin and update it as you release new versions.
    2222 */
    23 define( 'MINIORANGE_API_AUTHENTICATION_VERSION', '2.4.0' );
     23define( 'MINIORANGE_API_AUTHENTICATION_VERSION', '2.3.0' );
    2424// require_once plugin_dir_path( __FILE__ ) . 'admin/partials/support/class-mo-api-authentication-feedback.php';
    2525
Note: See TracChangeset for help on using the changeset viewer.