CiviCRM Community Forums (archive)

While I was working on an issue (CRM-10360) at the civicon code sprint, I discovered that while contacts with an api key but without a corresponding drupal user can't bootstrap drupal, they can still use the REST api (possibly just failing to have a hook in a drupal module fire). The person using the REST api would still need the site key or a PHPSESSID, but this is still a case of permissions being ignored and seems like a potential security issue.

Any comments or opinions?

I have submitted two PR's that deal with the rest bootstrap issue.

This first one makes api calls using entity/action bootstrap:
https://github.com/civicrm/civicrm-core/pull/519

This one returns an error when the cms user doesn't exist:
https://github.com/civicrm/civicrm-core/pull/523

So it wasn't as simple as just bootstrapping, but these two fixes get the job done.

Colby and I have been talking about how to unit-test the REST interface ( http://issues.civicrm.org/jira/browse/CRM-12412 ), and we looked at CiviSeleniumTestCase::rest_civicrm_api() for an example of calling REST from PHPUnit. There's an interesting comment there:

"Experimental - currently only works if permissions on remote site allow anon user to access ajax api"

It seems there are multiple URLs for receiving REST-style calls -- civicrm/ajax/rest, civicrm/api/json, and extern/rest.php. It seems the differences are:

 * civicrm/ajax/rest - Intended for use in a web-browser where the user session/cookie are managed by the CMS without any REST or AJAX calls. There is no explicit authentication mechanism (because CMS handles that).
 * extern/rest.php - Intended for use with third-party applications. The application still needs to setup a session/cookie, but they can go through Civi (providing api_key or user/pass) rather than POST'ing to a CMS form. However, they must also provide the site's API key.

As for civicrm/api/json, I think it's a nicer and more meaningful url than civicrm/ajax/rest (that isn't rest and expects a session cookie and doesn't "explain" it's the api).

We've been able to migrate the url for civicrm/api/explorer and civicrm/api/doc but not yet to civicrm/api/json.

Don't tell anyone, it's the master plan. If the ghost in the machine is with us, we'll succeed.

X+