20use Luracast\Restler\RestException;
22require_once DOL_DOCUMENT_ROOT.
'/core/lib/security.lib.php';
23require_once DOL_DOCUMENT_ROOT.
'/user/class/user.class.php';
45 throw new RestException(403,
"Error login APIs are disabled. You must get the token from backoffice to be able to use APIs");
70 return $this->
index($login, $password, $entity, $reset);
92 public function index($login, $password, $entity =
'', $reset = 0)
94 global $conf, $dolibarr_main_authentication, $dolibarr_auto_user;
98 dol_syslog(
"Warning: A try to use the login API has been done while the login API is disabled. You must generate or get the token from the backoffice.", LOG_WARNING);
99 throw new RestException(403,
"Error, the login API has been disabled for security purpose. You must generate or get the token from the backoffice.");
103 if (empty($dolibarr_main_authentication)) {
104 $dolibarr_main_authentication =
'dolibarr';
108 if ($dolibarr_main_authentication ==
'forceuser') {
109 if (empty($dolibarr_auto_user)) {
110 $dolibarr_auto_user =
'auto';
112 if ($dolibarr_auto_user != $login) {
113 dol_syslog(
"Warning: your instance is set to use the automatic forced login '".$dolibarr_auto_user.
"' that is not the requested login. API usage is forbidden in this mode.");
114 throw new RestException(403,
"Your instance is set to use the automatic login '".$dolibarr_auto_user.
"' that is not the requested login. API usage is forbidden in this mode.");
119 $authmode = explode(
',', $dolibarr_main_authentication);
121 if ($entity !=
'' && !is_numeric($entity)) {
122 throw new RestException(403,
"Bad value for entity, must be the numeric ID of company.");
128 include_once DOL_DOCUMENT_ROOT.
'/core/lib/security2.lib.php';
130 if ($login ===
'--bad-login-validity--') {
134 throw new RestException(403,
'Access denied');
137 $token =
'failedtogenerateorgettoken';
139 $tmpuser =
new User($this->db);
140 $tmpuser->fetch(0, $login, 0, 0, $entity);
141 if (empty($tmpuser->id)) {
142 throw new RestException(500,
'Failed to load user');
146 if (empty($tmpuser->api_key) || $reset) {
147 $tmpuser->getrights();
148 if (!$tmpuser->hasRight(
'user',
'self',
'creer')) {
149 if (empty($tmpuser->api_key)) {
150 throw new RestException(403,
'No API token set for this user and user need write permission on itself to reset its API token');
152 throw new RestException(403,
'User need write permission on itself to reset its API token');
160 $sql =
"UPDATE ".MAIN_DB_PREFIX.
"user";
161 $sql .=
" SET api_key = '".$this->db->escape(
dolEncrypt($token,
'',
'',
'dolibarr')).
"'";
162 $sql .=
" WHERE login = '".$this->db->escape($login).
"'";
164 dol_syslog(get_class($this).
"::login", LOG_DEBUG);
165 $result = $this->db->query($sql);
167 throw new RestException(500,
'Error when updating api_key for user :'.$this->db->lasterror());
170 $token = $tmpuser->api_key;
172 throw new RestException(500,
'Error, the API token of this user has a non valid value. Try to update it with a valid value.');
177 throw new RestException(500,
'Error the token for this user has not an hexa format. Try first to reset it.');
185 'entity' => $tmpuser->entity,
186 'message' =>
'Welcome '.$login.($reset ?
' - Token is new' :
' - This is your token (recorded for your user). You can use it to make any REST API call, or enter it into the DOLAPIKEY field to use the Dolibarr API explorer.')
API that allows to log in with an user account.
__construct()
Constructor of the class.
index($login, $password, $entity='', $reset=0)
Login.
loginUnsecured($login, $password, $entity='', $reset=0)
Login.
Class to manage Dolibarr users.
ascii_check($str)
Check if a string is in ASCII.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
utf8_check($str)
Check if a string is in UTF8.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
checkLoginPassEntity($usertotest, $passwordtotest, $entitytotest, $authmode, $context='')
Return a login if login/pass was successful.
dolEncrypt($chain, $key='', $ciphering='AES-256-CTR', $forceseed='')
Encode a string with a symmetric encryption.
dol_hash($chain, $type='0', $nosalt=0)
Returns a hash (non reversible encryption) of a string.