Adds inside proxy with nonce

wp-config-sample.php

@@ -80,6 +80,8 @@ define('WPLANG', 'nb_NO');
  */
 define('WP_DEBUG', false);
 
+define('NEUF_INSIDE_API_KEY', '');
+
 /* That's all, stop editing! Happy blogging. */
 
 /** Absolute path to the WordPress directory. */

wp-content/themes/aktiv2014/app/scripts/main.js

@@ -2,8 +2,7 @@
 /*global moment, jQuery, document, _ */
 var program_endpoint = 'https://studentersamfundet.no/api/events/get_upcoming/';
 var inside_url = 'https://inside.studentersamfundet.no';
-var user_search_endpoint = inside_url + '/api/user.php';
-//var user_search_endpoint = 'http://inside.dev/api/user.php';
+var user_search_endpoint = '/inside-api/';
 var query_params = {
     //meta_key: '_neuf_events_starttime',
     //meta_value: moment().add('days', 1).format('X'),
@@ -91,7 +90,8 @@ jQuery(document).ready(function() {
     });
     $('.search-field').on('keyup keypress', _.debounce(function(e) {
         if(e.target.value.length > 2) {
-            $.getJSON(user_search_endpoint, {q: e.target.value}, function(data) {
+            $.getJSON(user_search_endpoint, {q: e.target.value, _wpnonce: $('meta[name=x-inside-api-nonce').attr('content')}, function(data) {
+                console.log(data);
                 if(data.meta.num_results === 0) {
                     $('.search-result-list').html('Ingen treff.');
                     $('.search-results .meta').html('');

wp-content/themes/aktiv2014/dist/scripts/main.js

@@ -1 +1 @@
-"use strict";function format_posts(t){var e="",n=0;if(0===t.length)return"";for(e+='<thead><tr class="fadein"><th width="53%">Arrangement</th><th>Sted</th><th>Tid</th></tr></thead>',n=0;n<t.length;n++){var r=t[n];e+='<tr class="fadein">',e+='<td class="entry-title"><a href="'+r.url+'">'+r.title+"</a></td>",e+='<td class="entry-venue">'+r.custom_fields._neuf_events_venue+"</td>",e+='<td class="entry-starttime">'+moment.unix(r.custom_fields._neuf_events_starttime).utc().format("DD. MMMM YYYY, HH.mm")+"</td></tr>"}return e}var program_endpoint="https://studentersamfundet.no/api/events/get_upcoming/",inside_url="https://inside.studentersamfundet.no",user_search_endpoint=inside_url+"/api/user.php",query_params={count:10},entrypoint=".program-list";jQuery(document).ready(function(){moment.lang("nb");var t=jQuery;t.getJSON(program_endpoint+"?callback=?",query_params,function(e){if(e&&e.events){var n=format_posts(e.events);t(entrypoint).html(n)}}),t("#menu .menu-toggle").on("click",function(e){e.preventDefault();var n=t("#menu .main-menu, #menu .user-menu-wrap");n.toggleClass("visible")}),t("#menu a.profile-badge").on("click",function(e){e.preventDefault();var n=t("#menu .user-menu");n.toggleClass("visible")}),t("[data-toggle-introduction]").on("click",function(){t(this).parent().fadeOut(600),t.cookie("introduction-dismissed","1")}),"1"!==t.cookie("introduction-dismissed")&&(t(".introduction").show(),t(".introduction").addClass("fadein")),t(".search-field").focus();var e="<table><thead><tr><th>Navn</th><th>Brukernavn</th><th>Epost</th><th>Telefon</th><th>Medlem</th><th>Grupper</th></tr></thead>";t(".search-field").on("keyup keypress",function(t){(10===t.keyCode||13===t.keyCode)&&t.preventDefault()}),t(".search-field").on("keyup keypress",_.debounce(function(n){n.target.value.length>2?t.getJSON(user_search_endpoint,{q:n.target.value},function(n){if(0===n.meta.num_results)return t(".search-result-list").html("Ingen treff."),void t(".search-results .meta").html("");var r='<tbody><% _.each(results, function(u) { %><tr><td><a href="'+inside_url+'/?page=display-user&userid=<%= u.id %>"><%= u.firstname %> <%= u.lastname %></a></td><td><%= u.username %></td><td><a href="mailto:<%= u.email %>"><%= u.email %></a></td><td><a href="tlf:<%= u.number %>"><%= u.number %></a></td><td><% if(u.is_member != 0) { %>Ja<% } else { %>Nei<% } %></td><td class="groups"><%= u.groups %></td></li> <% }); %></tbody></table>',s=e+_.template(r,n);t(".search-result-list").html(s);var a="Antall treff: <%= meta.num_results %>";t(".search-results .meta").html(_.template(a,n))}):(t(".search-result-list").html("Skriv minst 3 tegn."),t(".search-results .meta").html(""))},300))});
+"use strict";function format_posts(t){var e="",n=0;if(0===t.length)return"";for(e+='<thead><tr class="fadein"><th width="53%">Arrangement</th><th>Sted</th><th>Tid</th></tr></thead>',n=0;n<t.length;n++){var r=t[n];e+='<tr class="fadein">',e+='<td class="entry-title"><a href="'+r.url+'">'+r.title+"</a></td>",e+='<td class="entry-venue">'+r.custom_fields._neuf_events_venue+"</td>",e+='<td class="entry-starttime">'+moment.unix(r.custom_fields._neuf_events_starttime).utc().format("DD. MMMM YYYY, HH.mm")+"</td></tr>"}return e}var program_endpoint="https://studentersamfundet.no/api/events/get_upcoming/",inside_url="https://inside.studentersamfundet.no",user_search_endpoint="/inside-api/",query_params={count:10},entrypoint=".program-list";jQuery(document).ready(function(){moment.lang("nb");var t=jQuery;t.getJSON(program_endpoint+"?callback=?",query_params,function(e){if(e&&e.events){var n=format_posts(e.events);t(entrypoint).html(n)}}),t("#menu .menu-toggle").on("click",function(e){e.preventDefault();var n=t("#menu .main-menu, #menu .user-menu-wrap");n.toggleClass("visible")}),t("#menu a.profile-badge").on("click",function(e){e.preventDefault();var n=t("#menu .user-menu");n.toggleClass("visible")}),t("[data-toggle-introduction]").on("click",function(){t(this).parent().fadeOut(600),t.cookie("introduction-dismissed","1")}),"1"!==t.cookie("introduction-dismissed")&&(t(".introduction").show(),t(".introduction").addClass("fadein")),t(".search-field").focus();var e="<table><thead><tr><th>Navn</th><th>Brukernavn</th><th>Epost</th><th>Telefon</th><th>Medlem</th><th>Grupper</th></tr></thead>";t(".search-field").on("keyup keypress",function(t){(10===t.keyCode||13===t.keyCode)&&t.preventDefault()}),t(".search-field").on("keyup keypress",_.debounce(function(n){n.target.value.length>2?t.getJSON(user_search_endpoint,{q:n.target.value,_wpnonce:t("meta[name=x-inside-api-nonce").attr("content")},function(n){if(console.log(n),0===n.meta.num_results)return t(".search-result-list").html("Ingen treff."),void t(".search-results .meta").html("");var r='<tbody><% _.each(results, function(u) { %><tr><td><a href="'+inside_url+'/?page=display-user&userid=<%= u.id %>"><%= u.firstname %> <%= u.lastname %></a></td><td><%= u.username %></td><td><a href="mailto:<%= u.email %>"><%= u.email %></a></td><td><a href="tlf:<%= u.number %>"><%= u.number %></a></td><td><% if(u.is_member != 0) { %>Ja<% } else { %>Nei<% } %></td><td class="groups"><%= u.groups %></td></li> <% }); %></tbody></table>',s=e+_.template(r,n);t(".search-result-list").html(s);var a="Antall treff: <%= meta.num_results %>";t(".search-results .meta").html(_.template(a,n))}):(t(".search-result-list").html("Skriv minst 3 tegn."),t(".search-results .meta").html(""))},300))});

wp-content/themes/aktiv2014/header.php

@@ -5,6 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <meta name="robots" content="index,follow" />
     <meta name="x-stylesheet-directory" content="<?php bloginfo( 'stylesheet_directory' ); ?>" />
+    <meta name="x-inside-api-nonce" content="<?php echo wp_create_nonce( 'inside-api' ); ?>" />
     <?php neuf_doctitle(); ?>
     <link rel="icon" type="image/png" href="favicon.png" />
     <link rel="alternate" type="application/rss+xml" href="<?php bloginfo('url'); ?>/feed/" title="Aktiv-nyheter" />

wp-content/themes/aktiv2014/page-inside-proxy.php

@@ -0,0 +1,32 @@
+<?php
+/*
+ * Template Name: Inside Proxy
+ */
+define('INSIDE_URL', 'https://inside.studentersamfundet.no/api/');
+
+function return_json($result) {
+    die(json_encode($result));
+}
+
+if( !isset($_GET['q']) ) {
+    return_json(array('error' => 'Missing arg q'));
+}
+
+$nonce_action = 'inside-api';
+if(!wp_verify_nonce($_GET['_wpnonce'], $nonce_action)) {
+    $result = array('error' => 'invalid nonce');
+    return_json($result);
+}
+$args = array(
+    'q' => $_GET['q'],
+    'apikey' => INSIDE_API_KEY
+);
+
+//$send_result = wp_mail( $to, $subject, $message, $headers);
+$ch = curl_init(INSIDE_URL.'/user.php?'.http_build_query($args));
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+curl_setopt($ch, CURLOPT_ENCODING ,"");
+curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json; charset=UTF-8'));
+
+$result = curl_exec($ch);
+echo $result;