Update composer dependancies

composer.json

@@ -6,7 +6,7 @@
 	"prefer-stable": true,
 	"minimum-stability": "dev",
 	"require": {
-		"elgg/elgg": "2.3.14"
+		"elgg/elgg": "2.3.15"
 	},
 	"require-dev": {
 		"srokap/code_review": "^1.0.5",

mod/web_services/languages/en.php

@@ -39,4 +39,14 @@
 
 	'system.api.list' => "List all available API calls on the system.",
 	'auth.gettoken' => "This API call lets a user obtain a user authentication token which can be used for authenticating future API calls. Pass it as the parameter auth_token",
+
+	// plugin settings
+	'web_services:settings:authentication' => "Web API authentication settings",
+	'web_services:settings:authentication:description' => "Some API methods require that the external sources authenticate themselves. These external sources need to be provided with an API key pair (public and secret key).
+
+Please note that at least one API authentication method needs to be active in order to authenticate API requests.",
+	'web_services:settings:authentication:allow_key' => "Allow basic API public key authentication",
+	'web_services:settings:authentication:allow_key:help' => "The API public key can be passed as a parameter in the request.",
+	'web_services:settings:authentication:allow_hmac' => "Allow HMAC header API authentication",
+	'web_services:settings:authentication:allow_hmac:help' => "With HMAC authentication special headers need to be passed in a request to ensure authenticity of the request.",
 );

mod/web_services/start.php

@@ -46,7 +46,7 @@ function ws_init() {
 
 /**
  * Handle a web service request
- * 
+ *
  * Handles requests of format: http://site/services/api/handler/response_format/request
  * The first element after 'services/api/' is the service handler name as
  * registered by {@link register_service_handler()}.
@@ -57,7 +57,7 @@ function ws_init() {
  * function registered by {@link register_service_handler()}.
  *
  * If a service handler isn't found, a 404 header is sent.
- * 
+ *
  * @param array $segments URL segments
  * @return bool
  */
@@ -323,9 +323,13 @@ function ws_rest_handler() {
 		register_pam_handler('pam_auth_usertoken');
 
 		// simple API key check
-		register_pam_handler('api_auth_key', "sufficient", "api");
+		if (elgg_get_plugin_setting('auth_allow_key', 'web_services', 1)) {
+			register_pam_handler('api_auth_key', 'sufficient', 'api');
+		}
 		// hmac
-		register_pam_handler('api_auth_hmac', "sufficient", "api");
+		if (elgg_get_plugin_setting('auth_allow_hmac', 'web_services', 1)) {
+			register_pam_handler('api_auth_hmac', 'sufficient', 'api');
+		}
 	}
 
 	// Get parameter variables
@@ -366,7 +370,7 @@ function ws_unit_test($hook, $type, $value, $params) {
 
 /**
  * Filters system API list to remove PHP internal function names
- * 
+ *
  * @param string $hook   "rest:output"
  * @param string $type   "system.api.list"
  * @param array  $return API list

mod/web_services/views/default/plugins/web_services/settings.php

@@ -0,0 +1,33 @@
+<?php
+/**
+ * Plugin settings for the WebServices plugin
+ *
+ * @uses $vars['entity'] the plugin entity
+ */
+
+/* @var $plugin ElggPlugin */
+$plugin = elgg_extract('entity', $vars);
+
+$authentication = elgg_view('output/longtext', [
+	'value' => elgg_echo('web_services:settings:authentication:description'),
+]);
+
+$authentication .= elgg_view_field([
+	'#type' => 'checkbox',
+	'#label' => elgg_echo('web_services:settings:authentication:allow_key'),
+	'#help' => elgg_echo('web_services:settings:authentication:allow_key:help'),
+	'name' => 'params[auth_allow_key]',
+	'value' => 1,
+	'checked' => (bool) $plugin->getSetting('auth_allow_key', 1),
+]);
+
+$authentication .= elgg_view_field([
+	'#type' => 'checkbox',
+	'#label' => elgg_echo('web_services:settings:authentication:allow_hmac'),
+	'#help' => elgg_echo('web_services:settings:authentication:allow_hmac:help'),
+	'name' => 'params[auth_allow_hmac]',
+	'value' => 1,
+	'checked' => (bool) $plugin->getSetting('auth_allow_hmac', 1),
+]);
+
+echo elgg_view_module('inline', elgg_echo('web_services:settings:authentication'), $authentication);

vendor/autoload.php

@@ -4,4 +4,4 @@
 
 require_once __DIR__ . '/composer/autoload_real.php';
 
-return ComposerAutoloaderInitb8afdb76c5c69892c8cf123cfea12777::getLoader();
+return ComposerAutoloaderInit7f6df2d14db08363d3131db6786538b3::getLoader();

vendor/composer/ClassLoader.php

@@ -279,7 +279,7 @@ public function isClassMapAuthoritative()
      */
     public function setApcuPrefix($apcuPrefix)
     {
-        $this->apcuPrefix = function_exists('apcu_fetch') && filter_var(ini_get('apc.enabled'), FILTER_VALIDATE_BOOLEAN) ? $apcuPrefix : null;
+        $this->apcuPrefix = function_exists('apcu_fetch') && ini_get('apc.enabled') ? $apcuPrefix : null;
     }
 
     /**
@@ -377,7 +377,7 @@ private function findFileWithExtension($class, $ext)
             $subPath = $class;
             while (false !== $lastPos = strrpos($subPath, '\\')) {
                 $subPath = substr($subPath, 0, $lastPos);
-                $search = $subPath . '\\';
+                $search = $subPath.'\\';
                 if (isset($this->prefixDirsPsr4[$search])) {
                     $pathEnd = DIRECTORY_SEPARATOR . substr($logicalPathPsr4, $lastPos + 1);
                     foreach ($this->prefixDirsPsr4[$search] as $dir) {

vendor/composer/LICENSE

@@ -1,21 +1,56 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: Composer
+Upstream-Contact: Jordi Boggiano <[email protected]>
+Source: https://github.com/composer/composer
 
-Copyright (c) Nils Adermann, Jordi Boggiano
+Files: *
+Copyright: 2016, Nils Adermann <[email protected]>
+           2016, Jordi Boggiano <[email protected]>
+License: Expat
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is furnished
-to do so, subject to the following conditions:
+Files: src/Composer/Util/TlsHelper.php
+Copyright: 2016, Nils Adermann <[email protected]>
+           2016, Jordi Boggiano <[email protected]>
+           2013, Evan Coury <[email protected]>
+License: Expat and BSD-2-Clause
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+License: BSD-2-Clause
+ Redistribution and use in source and binary forms, with or without modification,
+ are permitted provided that the following conditions are met:
+ .
+     * Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+ .
+     * Redistributions in binary form must reproduce the above copyright notice,
+       this list of conditions and the following disclaimer in the documentation
+       and/or other materials provided with the distribution.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+License: Expat
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is furnished
+ to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.