login/token.php

   1 <?php
   2 // This file is part of Moodle - http://moodle.org/
   3 //
   4 // Moodle is free software: you can redistribute it and/or modify
   5 // it under the terms of the GNU General Public License as published by
   6 // the Free Software Foundation, either version 3 of the License, or
   7 // (at your option) any later version.
   8 //
   9 // Moodle is distributed in the hope that it will be useful,
  10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 // GNU General Public License for more details.
  13 //
  14 // You should have received a copy of the GNU General Public License
  15 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  16
  17 /**
  18  * Return token
  19  * @package    moodlecore
  20  * @copyright  2011 Dongsheng Cai <dongsheng@moodle.com>
  21  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  22  */
  23
  24 define('AJAX_SCRIPT', true);
  25 define('REQUIRE_CORRECT_ACCESS', true);
  26 define('NO_MOODLE_COOKIES', true);
  27
  28 require_once(__DIR__ . '/../config.php');
  29 require_once($CFG->libdir . '/externallib.php');
  30
  31 // Allow CORS requests.
  32 header('Access-Control-Allow-Origin: *');
  33
  34 $username = required_param('username', PARAM_USERNAME);
  35 $password = required_param('password', PARAM_RAW);
  36 $serviceshortname  = required_param('service',  PARAM_ALPHANUMEXT);
  37
  38 echo $OUTPUT->header();
  39
  40 if (!$CFG->enablewebservices) {
  41     throw new moodle_exception('enablewsdescription', 'webservice');
  42 }
  43 $username = trim(core_text::strtolower($username));
  44 if (is_restored_user($username)) {
  45     throw new moodle_exception('restoredaccountresetpassword', 'webservice');
  46 }
  47
  48 $systemcontext = context_system::instance();
  49
  50 $user = authenticate_user_login($username, $password);
  51 if (!empty($user)) {
  52
  53     // Cannot authenticate unless maintenance access is granted.
  54     $hasmaintenanceaccess = has_capability('moodle/site:maintenanceaccess', $systemcontext, $user);
  55     if (!empty($CFG->maintenance_enabled) and !$hasmaintenanceaccess) {
  56         throw new moodle_exception('sitemaintenance', 'admin');
  57     }
  58
  59     if (isguestuser($user)) {
  60         throw new moodle_exception('noguest');
  61     }
  62     if (empty($user->confirmed)) {
  63         throw new moodle_exception('usernotconfirmed', 'moodle', '', $user->username);
  64     }
  65     // check credential expiry
  66     $userauth = get_auth_plugin($user->auth);
  67     if (!empty($userauth->config->expiration) and $userauth->config->expiration == 1) {
  68         $days2expire = $userauth->password_expire($user->username);
  69         if (intval($days2expire) < 0 ) {
  70             throw new moodle_exception('passwordisexpired', 'webservice');
  71         }
  72     }
  73
  74     // let enrol plugins deal with new enrolments if necessary
  75     enrol_check_plugins($user);
  76
  77     // setup user session to check capability
  78     \core\session\manager::set_user($user);
  79
  80     //check if the service exists and is enabled
  81     $service = $DB->get_record('external_services', array('shortname' => $serviceshortname, 'enabled' => 1));
  82     if (empty($service)) {
  83         // will throw exception if no token found
  84         throw new moodle_exception('servicenotavailable', 'webservice');
  85     }
  86
  87     // Get an existing token or create a new one.
  88     $token = external_generate_token_for_current_user($service);
  89     $privatetoken = $token->privatetoken;
  90     $token->privatetoken = null;
  91
  92     // log token access
  93     $DB->set_field('external_tokens', 'lastaccess', time(), array('id'=>$token->id));
  94
  95     $params = array(
  96         'objectid' => $token->id,
  97     );
  98     $event = \core\event\webservice_token_sent::create($params);
  99     $event->add_record_snapshot('external_tokens', $token);
 100     $event->trigger();
 101
 102     $siteadmin = has_capability('moodle/site:config', $systemcontext, $USER->id) || is_siteadmin($USER->id);
 103
 104     $usertoken = new stdClass;
 105     $usertoken->token = $token->token;
 106     // Private token, only transmitted to https sites and non-admin users.
 107     if (is_https() and !$siteadmin) {
 108         $usertoken->privatetoken = $privatetoken;
 109     } else {
 110         $usertoken->privatetoken = null;
 111     }
 112     echo json_encode($usertoken);
 113 } else {
 114     throw new moodle_exception('invalidlogin');
 115 }