var $id;

var $ht;

function __construct($id) {

$this->id = 0;

$this->load($id);

}

function load($id=0) {

if(!$id && !($id=$this->getId()))

return false;

$sql='SELECT * FROM '.API_KEY_TABLE.' WHERE id='.db_input($id);

if(!($res=db_query($sql)) || !db_num_rows($res))

return false;

$this->ht = db_fetch_array($res);

$this->id = $this->ht['id'];

return true;

}

function reload() {

return $this->load();

}

function getId() {

return $this->id;

}

function getKey() {

return $this->ht['apikey'];

}

function getIPAddr() {

return $this->ht['ipaddr'];

}

function getNotes() {

return $this->ht['notes'];

}

function getHashtable() {

return $this->ht;

}

function isActive() {

return ($this->ht['isactive']);

}

function canCreateTickets() {

return ($this->ht['can_create_tickets']);

}

function canExecuteCron() {

return ($this->ht['can_exec_cron']);

}

function update($vars, &$errors) {

if(!API::save($this->getId(), $vars, $errors))

return false;

$this->reload();

return true;

}

function delete() {

$sql='DELETE FROM '.API_KEY_TABLE.' WHERE id='.db_input($this->getId()).' LIMIT 1';

return (db_query($sql) && ($num=db_affected_rows()));

}

/** Static functions **/

static function add($vars, &$errors) {

return API::save(0, $vars, $errors);

}

static function validate($key, $ip) {

return ($key && $ip && self::getIdByKey($key, $ip));

}

static function getIdByKey($key, $ip='') {

$sql='SELECT id FROM '.API_KEY_TABLE.' WHERE apikey='.db_input($key);

if($ip)

$sql.=' AND ipaddr='.db_input($ip);

if(($res=db_query($sql)) && db_num_rows($res))

list($id) = db_fetch_row($res);

return $id;

}

static function lookupByKey($key, $ip='') {

return self::lookup(self::getIdByKey($key, $ip));

}

static function lookup($id) {

return ($id && is_numeric($id) && ($k= new API($id)) && $k->getId()==$id)?$k:null;

}

static function save($id, $vars, &$errors) {

if(!$id && (!$vars['ipaddr'] || !Validator::is_ip($vars['ipaddr'])))

$errors['ipaddr'] = __('Valid IP is required');

if($errors) return false;

$sql=' updated=NOW() '

.',isactive='.db_input($vars['isactive'])

.',can_create_tickets='.db_input($vars['can_create_tickets'])

.',can_exec_cron='.db_input($vars['can_exec_cron'])

.',notes='.db_input(Format::sanitize($vars['notes']));

if($id) {

$sql='UPDATE '.API_KEY_TABLE.' SET '.$sql.' WHERE id='.db_input($id);

if(db_query($sql))

return true;

$errors['err']=sprintf(__('Unable to update %s.'), __('this API key'))

.' '.__('Internal error occurred');

} else {

$sql='INSERT INTO '.API_KEY_TABLE.' SET '.$sql

.',created=NOW() '

.',ipaddr='.db_input($vars['ipaddr'])

.',apikey='.db_input(strtoupper(md5(time().$vars['ipaddr'].md5(Misc::randCode(16)))));

if(db_query($sql) && ($id=db_insert_id()))

return $id;

$errors['err']=sprintf('%s %s',

sprintf(__('Unable to add %s.'), __('this API key')),

__('Correct any errors below and try again.'));

}

return false;

}

private $sapi;

private $key;

public function __construct($sapi = null) {

// Set API Interface the request is coming from

$this->sapi = $sapi ?: (osTicket::is_cli() ? 'cli' : 'http');

}

public function isCli() {

return (strcasecmp($this->sapi, 'cli') === 0);

}

private function getInputStream() {

return $this->isCli() ? 'php://stdin' : 'php://input';

}

protected function getRemoteAddr() {

return $_SERVER['REMOTE_ADDR'];

}

protected function getApiKey() {

return $_SERVER['HTTP_X_API_KEY'];

}

function requireApiKey() {

// Require a valid API key sent as X-API-Key HTTP header

// see getApiKey method.

if (!($key=$this->getKey()))

return $this->exerr(401, __('Valid API key required'));

elseif (!$key->isActive() || $key->getIPAddr() != $this->getRemoteAddr())

return $this->exerr(401, __('API key not found/active or source IP not authorized'));

return $key;

}

function getKey() {

// Lookup record using sent API Key && IP Addr

if (!$this->key

&& ($key=$this->getApiKey())

&& ($ip=$this->getRemoteAddr()))

$this->key = API::lookupByKey($key, $ip);

return $this->key;

}

/**

function getRequest($format, $validate=true) {

$input = $this->getInputStream();

if (!($stream = @fopen($input, 'r')))

$this->exerr(400, sprintf('%s (%s)',

__("Unable to read request body"), $input));

return $this->parseRequest($stream, $format, $validate);

}

function getEmailRequest() {

if (!($data=$this->getRequest('email', false)))

$this->exerr(400, __("Unable to read email request"));

return $data;

}

function parseRequest($stream, $format, $validate=true) {

$parser = null;

switch(strtolower($format)) {

case 'xml':

if (!function_exists('xml_parser_create'))

return $this->exerr(501, __('XML extension not supported'));

$parser = new ApiXmlDataParser();

break;

case 'json':

$parser = new ApiJsonDataParser();

break;

case 'email':

$parser = new ApiEmailDataParser();

break;

default:

return $this->exerr(415, __('Unsupported data format'));

}

if (!($data = $parser->parse($stream)) || !is_array($data)) {

$this->exerr(400, $parser->lastError());

}

//Validate structure of the request.

if ($validate && $data)

$this->validate($data, $format, false);

return $data;

}

function parseEmail($content) {

return $this->parseRequest($content, 'email', false);

}

/**

function getRequestStructure($format, $data=null) { return array(); }

/**

function validateRequestStructure($data, $structure, $prefix="", $strict=true) {

global $ost;

foreach ($data as $key=>$info) {

if (is_array($structure) && (is_array($info) || $info instanceof ArrayAccess)) {

$search = (isset($structure[$key]) && !is_numeric($key)) ? $key : "*";

if (isset($structure[$search])) {

$this->validateRequestStructure($info, $structure[$search], "$prefix$key/", $strict);

continue;

}

} elseif (in_array($key, $structure)) {

continue;

}

$error = sprintf(__("%s: Unexpected data received in API request"),

"$prefix$key");

$this->onError(400, $error, __('Unexpected Data'), !$strict);

}

return true;

}

/**

function validate(&$data, $format, $strict=true) {

return $this->validateRequestStructure(

$data,

$this->getRequestStructure($format, $data),

"",

$strict);

}

protected function debug($subj, $msg) {

return $this->log($subj, $msg, LOG_DEBUG);

}

protected function logError($subj, $msg, $fatal=false) {

// If error is not fatal then log it as a warning

return $this->log($subj, $msg, $fatal ? LOG_ERR : LOG_WARN);

}

protected function log($title, $msg, $level = LOG_WARN) {

global $ost;

switch ($level) {

case LOG_WARN:

case LOG_ERR:

// We are disabling email alerts on API errors / warnings

// due to potential abuse or loops that might cause email DOS

$ost->log($level, $title, $msg, false);

break;

case LOG_DEBUG:

default:

$ost->logDebug($title, $msg);

}

return true;

}

/**

final public function onError($code, $error, $title = null,

$logOnly = false) {

// Unpack the errors to string if error is an array

if ($error && is_array($error))

$error = Format::array_implode(": ", "\n", $error);

// Log the error

$msg = $error;

// TODO: Only include API Key when in debug mode to avoid

// potentialialy leaking a valid key in system logs

if (($key=$this->getApiKey()))

$msg .= "\n[$key]\n";

$title = sprintf('%s (%s)', $title ?: __('API Error'), $code);

$this->logError($title, $msg, $logOnly);

// If the error is not deemed fatal then simply return

if ($logOnly)

return;

// If the API Interface is CLI then throw a TicketApiError exception

// so the caller can handle the error gracefully.

// Note that we set the error code as well

if ($this->isCli())

throw new TicketApiError($error, $code);

// Respond and exit since HTTP endpoint requests

// are considered stateless

$this->response($code, $error);

}

function parse($stream) {

return $this->fixup(parent::parse($stream));

}

/**

function fixup($current) {

global $cfg;

if (isset($current['ticket']))

$current = $current['ticket'];

if (!is_array($current))

return $current;

foreach ($current as $key=>&$value) {

if ($key == "phone" && is_array($value)) {

$value = $value[":text"];

} else if ($key == "alert") {

$value = (bool) (strtolower($value) === 'false' ? false : $value);

} else if ($key == "autorespond") {

$value = (bool) (strtolower($value) === 'false' ? false : $value);

} else if ($key == "message") {

if (!is_array($value)) {

$value = array(

"body" => $value,

"type" => "text/plain",

# Use encoding from root <xml> node

);

} else {

$value["body"] = $value[":text"];

unset($value[":text"]);

}

if (isset($value['encoding']))

$value['body'] = Charset::utf8($value['body'], $value['encoding']);

if (!strcasecmp($value['type'], 'text/html'))

$value = new HtmlThreadEntryBody($value['body']);

else

$value = new TextThreadEntryBody($value['body']);

} else if ($key == "attachments") {

if(isset($value['file']) && !isset($value['file'][':text']))

$value = $value['file'];

if($value && is_array($value)) {

foreach ($value as &$info) {

$info["data"] = $info[":text"];

unset($info[":text"]);

}

unset($info);

}

} else if(is_array($value)) {

$value = $this->fixup($value);

}

}

unset($value);

return $current;

}

static function parse($stream, $tidy=false) {

return self::fixup(parent::parse($stream));

}

static function fixup($current) {

if (!is_array($current))

return $current;

foreach ($current as $key=>&$value) {

if ($key == "phone") {

$value = strtoupper($value);

} else if ($key == "alert") {

$value = (bool)$value;

} else if ($key == "autorespond") {

$value = (bool)$value;

} elseif ($key == "message") {

// Allow message specified in RFC 2397 format

$data = Format::strip_emoticons(Format::parseRfc2397($value, 'utf-8'));

if (isset($data['type']) && $data['type'] == 'text/html')

$value = new HtmlThreadEntryBody($data['data']);

else

$value = new TextThreadEntryBody($data['data']);

} else if ($key == "attachments") {

foreach ($value as &$info) {

$data = reset($info);

# PHP5: fopen("data://$data[5:]");

$contents = Format::parseRfc2397($data, 'utf-8', false);

$info = array(

"data" => $contents['data'],

"type" => $contents['type'],

"name" => key($info),

);

}

unset($info);

}

}

unset($value);

return $current;

}

function parse($stream) {

return $this->fixup(parent::parse($stream));

}

function fixup($data) {

global $cfg;

if (!$data) return $data;

$data['source'] = 'Email';

if (!$data['subject'])

$data['subject'] = '[No Subject]';

if (!$data['emailId'])

$data['emailId'] = $cfg->getDefaultEmailId();

if( !$cfg->useEmailPriority())

unset($data['priorityId']);

return $data;

}