[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * An XML-RPC server
   4   *
   5   * @author  Donal McMullan  [email protected]
   6   * @version 0.0.1
   7   * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
   8   * @package mnet
   9   */
  10  
  11  // Make certain that config.php doesn't display any errors, and that it doesn't
  12  // override our do-not-display-errors setting:
  13  // disable moodle specific debug messages and any errors in output
  14  define('NO_DEBUG_DISPLAY', true);
  15  // cookies are not used, makes sure there is empty global $USER
  16  define('NO_MOODLE_COOKIES', true);
  17  
  18  define('MNET_SERVER', true);
  19  
  20  require_once(dirname(dirname(dirname(__FILE__))) . '/config.php');
  21  
  22  $mnet = get_mnet_environment();
  23  // Include MNET stuff:
  24  require_once $CFG->dirroot.'/mnet/lib.php';
  25  require_once $CFG->dirroot.'/mnet/remote_client.php';
  26  require_once $CFG->dirroot.'/mnet/xmlrpc/serverlib.php';
  27  
  28  
  29  if ($CFG->mnet_dispatcher_mode === 'off') {
  30      print_error('mnetdisabled', 'mnet');
  31  }
  32  
  33  // Content type for output is not html:
  34  header('Content-type: text/xml; charset=utf-8');
  35  
  36  // PHP 5.2.2: $HTTP_RAW_POST_DATA not populated bug:
  37  // http://bugs.php.net/bug.php?id=41293
  38  if (empty($HTTP_RAW_POST_DATA)) {
  39      $HTTP_RAW_POST_DATA = file_get_contents('php://input');
  40  }
  41  
  42  mnet_debug("HTTP_RAW_POST_DATA", 2);
  43  mnet_debug($HTTP_RAW_POST_DATA, 2);
  44  
  45  if (!isset($_SERVER)) {
  46      exit(mnet_server_fault(712, get_string('phperror', 'mnet')));
  47  }
  48  
  49  
  50  // New global variable which ONLY gets set in this server page, so you know that
  51  // if you've been called by a remote Moodle, this should be set:
  52  $remoteclient = new mnet_remote_client();
  53  set_mnet_remote_client($remoteclient);
  54  
  55  try {
  56      $plaintextmessage = mnet_server_strip_encryption($HTTP_RAW_POST_DATA);
  57      $xmlrpcrequest = mnet_server_strip_signature($plaintextmessage);
  58  } catch (Exception $e) {
  59      mnet_debug('encryption strip exception thrown: ' . $e->getMessage());
  60      exit(mnet_server_fault($e->getCode(), $e->getMessage(), $e->a));
  61  }
  62  
  63  mnet_debug('XMLRPC Payload', 2);
  64  mnet_debug($xmlrpcrequest, 2);
  65  
  66  if($remoteclient->pushkey == true) {
  67      // The peer used one of our older public keys, we will return a
  68      // signed/encrypted error message containing our new public key
  69      // Sign message with our old key, and encrypt to the peer's private key.
  70      mnet_debug('sending back new key');
  71      exit(mnet_server_fault_xml(7025, $mnet->public_key, $remoteclient->useprivatekey));
  72  }
  73  // Have a peek at what the request would be if we were to process it
  74  $params = xmlrpc_decode_request($xmlrpcrequest, $method);
  75  mnet_debug("incoming mnet request $method");
  76  
  77  // One of three conditions need to be met before we continue processing this request:
  78  // 1. Request is properly encrypted and signed
  79  // 2. Request is for a keyswap (we don't mind enencrypted or unsigned requests for a public key)
  80  // 3. Request is properly signed and we're happy with it being unencrypted
  81  if ((($remoteclient->request_was_encrypted == true) && ($remoteclient->signatureok == true))
  82      || (($method == 'system.keyswap') || ($method == 'system/keyswap'))
  83      || (($remoteclient->signatureok == true) && ($remoteclient->plaintext_is_ok() == true))) {
  84      try {
  85          // main dispatch call.  will echo the response directly
  86          mnet_server_dispatch($xmlrpcrequest);
  87          mnet_debug('exiting cleanly');
  88          exit;
  89      } catch (Exception $e) {
  90          mnet_debug('dispatch exception thrown: ' . $e->getMessage());
  91          exit(mnet_server_fault($e->getCode(), $e->getMessage(), $e->a));
  92      }
  93  }
  94  // if we get to here, something is wrong
  95  // so detect a few common cases and send appropriate errors
  96  if (($remoteclient->request_was_encrypted == false) && ($remoteclient->plaintext_is_ok() == false)) {
  97      mnet_debug('non encrypted request');
  98      exit(mnet_server_fault(7021, get_string('forbidden-transport', 'mnet')));
  99  }
 100  
 101  if ($remoteclient->request_was_signed == false) {
 102      // Request was not signed
 103      mnet_debug('non signed request');
 104      exit(mnet_server_fault(711, get_string('verifysignature-error', 'mnet')));
 105  }
 106  
 107  if ($remoteclient->signatureok == false) {
 108      // We were unable to verify the signature
 109      mnet_debug('non verified signature');
 110      exit(mnet_server_fault(710, get_string('verifysignature-invalid', 'mnet')));
 111  }
 112  mnet_debug('unknown error');
 113  exit(mnet_server_fault(7000, get_string('unknownerror', 'mnet')));