#4148 - Build-in API support (cmts)

cmts.php

@@ -12,6 +12,8 @@ require_once(BX_DIRECTORY_PATH_INC . "design.inc.php");
 
 bx_import('BxDolLanguages');
 
+bx_api_check_origins();
+
 check_logged();
 
 $sSys = isset($_REQUEST['sys']) ? bx_process_input($_REQUEST['sys']) : '';

inc/utils.inc.php

@@ -2326,7 +2326,33 @@ function bx_absolute_url($sUrl, $sPrefix = BX_DOL_URL_ROOT)
 
 function bx_is_api()
 {
-    return defined('BX_API') ? true : false;
+    if (bx_get('api-acc')){
+        $iCookieTime = true ? time() + 60 * getParam('sys_session_lifetime_in_min') : 0;
+        bx_setcookie("memberID", 1, $iCookieTime, 'auto');
+        check_logged();
+    }
+    return defined('BX_API') || bx_get('api') ? true : false;
+}
+
+function bx_api_check_origins()
+{
+    if (isset($_SERVER['HTTP_ORIGIN']) && parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST) != parse_url(BX_DOL_URL_ROOT, PHP_URL_HOST)) {
+
+        $aAllowedOrigins = ['http://app.una.io:3000', 'http://ci.una.io:3000', 'http://localhost:3000', 'https://una.io']; // TODO: separate config
+        if (!in_array($_SERVER['HTTP_ORIGIN'], $aAllowedOrigins)) {
+            header('HTTP/1.0 403 Forbidden');
+            echo json_encode(['status' => 403, 'error' => _t("_Access denied")]);
+            exit;
+        } 
+
+        header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
+
+        if ('OPTIONS' == $_SERVER['REQUEST_METHOD']) {
+            header('Access-Control-Allow-Methods: POST, GET');
+            header('Access-Control-Allow-Headers: Accept-Encoding, Authorization, Cache-Control, Connection, Host, Origin, Pragma, Referer, User-Agent, X-Custom-Header, X-Requested-With');                    
+            exit;
+        }            
+    }
 }
 
 /** @} */

template/scripts/BxBaseCmts.php

@@ -104,7 +104,7 @@ class BxBaseCmts extends BxDolCmts
     {
         return $this->_sJsObjName;
     }
-
+    
     /**
      * Get initialization section of comments box
      *
@@ -1138,15 +1138,17 @@ class BxBaseCmts extends BxDolCmts
         return $mixedResult;
     }
 
-    protected function _getFormPost($iCmtParentId = 0, $aDp = [])
+    public function _getFormPost($iCmtParentId = 0, $aDp = [])
     {
         $bCmtParentId = !empty($iCmtParentId);
-        if(!$bCmtParentId && !$this->isPostAllowed())
-            return array('msg' => $this->msgErrPostAllowed());
-
-        if($bCmtParentId && !$this->isReplyAllowed($iCmtParentId))
-            return array('msg' => $this->msgErrReplyAllowed());
+        
+        if (!bx_is_api()){
+            if(!$bCmtParentId && !$this->isPostAllowed())
+                return array('msg' => $this->msgErrPostAllowed());
 
+            if($bCmtParentId && !$this->isReplyAllowed($iCmtParentId))
+                return array('msg' => $this->msgErrReplyAllowed());
+        }
         $bDynamic = isset($aDp['dynamic_mode']) && (bool)$aDp['dynamic_mode'];
         $bQuote = isset($aDp['quote']) && (bool)$aDp['quote'];
 
@@ -1230,8 +1232,7 @@ class BxBaseCmts extends BxDolCmts
 
             return array('msg' => _t('_cmt_err_cannot_perform_action'));
         }
-
-        return array('form' => $oForm->getCode($bDynamic), 'form_id' => $oForm->id);
+        return array('form' => $oForm->getCode($bDynamic), 'form_id' => $oForm->id, 'frm' => $oForm);
     }
 
     protected function _getFormEdit($iCmtId, $aDp = [])