Changeset 3055025

Timestamp:

03/20/2024 07:37:16 AM (2 years ago)

Author:

atomchat

Message:

Add permission check for using the rest routes

File:

• atomchat/trunk/atomchat.php (modified) (3 diffs)

atomchat/trunk/atomchat.php

@@ -149 +149 @@
             $role = get_role($value);
             $role->add_cap( 'enable_atomchat',true );
+            $role->add_cap( 'manage_credit_balance', true );
         }
         add_option('atomchat_show_friends','false','','no');
@@ -200 +201 @@
 if( !function_exists( 'atomchatDeductPointsCallback' ) ) {
     function atomchatDeductPointsCallback() {
-        include_once(dirname(__FILE__).DIRECTORY_SEPARATOR.'plugins'.DIRECTORY_SEPARATOR.'mycred'.DIRECTORY_SEPARATOR.'credits.php');
+        $auth_key = get_option('atomchat_auth_key');
+        $data = json_decode(file_get_contents('php://input'));
+        $server_secret = $data->secretkey;
+        $get_user_id = $data->UID;
+        $user = get_user_by( 'id', $get_user_id );
+        $randomString = $data->randomString;
+        $client_secret = md5(implode(',', [$user->id,$user->user_login,$auth_key,$randomString]));
+        if($client_secret == $server_secret){
+            include_once(dirname(__FILE__).DIRECTORY_SEPARATOR.'plugins'.DIRECTORY_SEPARATOR.'mycred'.DIRECTORY_SEPARATOR.'credits.php');
+        }else{
+            wp_send_json_error(array(
+               'code' => 'NOT_AUTHORIZED',
+               'message' => 'You are not authorized'
+           ), 401);
+        }   
     }
 }
@@ -224 +239 @@
 
 function atomchatDeductPointsPermissionCheck(WP_REST_Request $request) {
-    $atomchat_auth_key = get_option('atomchat_auth_key');
-    $encryption_key = $request->get_param('encryption_key');
-    if (password_verify($atomchat_auth_key, $encryption_key)) {
-        return true;
-    } else {
-        return false;
-    }
+    $data = json_decode(file_get_contents('php://input'));
+    $user_id = $data->UID;
+    if( $user_id ){
+        $user = get_user_by( 'id', $user_id );
+        if( $user && user_can($user, 'manage_credit_balance')){
+            return true;
+        }
+    }
+    return false;
 }