aurjson.class.php 19.6 KB
Newer Older
eliott's avatar
eliott committed
1
<?php
2

3
include_once("aur.inc.php");
Dan McGee's avatar
Dan McGee committed
4

5
6
7
8
/*
 * This class defines a remote interface for fetching data from the AUR using
 * JSON formatted elements.
 *
eliott's avatar
eliott committed
9
10
 * @package rpc
 * @subpackage classes
11
 */
eliott's avatar
eliott committed
12
class AurJSON {
13
	private $dbh = false;
14
	private $version = 1;
15
	private static $exposed_methods = array(
16
		'search', 'info', 'multiinfo', 'msearch', 'suggest',
17
		'suggest-pkgbase', 'get-comment-form'
18
	);
19
	private static $exposed_fields = array(
20
21
22
23
24
		'name', 'name-desc', 'maintainer',
		'depends', 'makedepends', 'checkdepends', 'optdepends'
	);
	private static $exposed_depfields = array(
		'depends', 'makedepends', 'checkdepends', 'optdepends'
25
	);
26
27
	private static $fields_v1 = array(
		'Packages.ID', 'Packages.Name',
28
		'PackageBases.ID AS PackageBaseID',
29
		'PackageBases.Name AS PackageBase', 'Version',
30
31
32
33
34
35
		'Description', 'URL', 'NumVotes', 'OutOfDateTS AS OutOfDate',
		'Users.UserName AS Maintainer',
		'SubmittedTS AS FirstSubmitted', 'ModifiedTS AS LastModified',
		'Licenses.Name AS License'
	);
	private static $fields_v2 = array(
36
		'Packages.ID', 'Packages.Name',
37
		'PackageBases.ID AS PackageBaseID',
38
		'PackageBases.Name AS PackageBase', 'Version',
39
40
41
42
		'Description', 'URL', 'NumVotes', 'OutOfDateTS AS OutOfDate',
		'Users.UserName AS Maintainer',
		'SubmittedTS AS FirstSubmitted', 'ModifiedTS AS LastModified'
	);
43
44
45
46
47
48
49
50
	private static $fields_v4 = array(
		'Packages.ID', 'Packages.Name',
		'PackageBases.ID AS PackageBaseID',
		'PackageBases.Name AS PackageBase', 'Version',
		'Description', 'URL', 'NumVotes', 'Popularity',
		'OutOfDateTS AS OutOfDate', 'Users.UserName AS Maintainer',
		'SubmittedTS AS FirstSubmitted', 'ModifiedTS AS LastModified'
	);
51
	private static $numeric_fields = array(
52
		'ID', 'PackageBaseID', 'NumVotes', 'OutOfDate',
53
		'FirstSubmitted', 'LastModified'
54
	);
55
56
57
	private static $decimal_fields = array(
		'Popularity'
	);
58
59
60
61
62
63
64
65
66
67
68
69
70
71

	/*
	 * Handles post data, and routes the request.
	 *
	 * @param string $post_data The post data to parse and handle.
	 *
	 * @return string The JSON formatted response data.
	 */
	public function handle($http_data) {
		/*
		 * Unset global aur.inc.php Pragma header. We want to allow
		 * caching of data in proxies, but require validation of data
		 * (if-none-match) if possible.
		 */
72
		header_remove('Pragma');
73
74
75
76
		/*
		 * Overwrite cache-control header set in aur.inc.php to allow
		 * caching, but require validation.
		 */
77
		header('Cache-Control: public, must-revalidate, max-age=0');
78
		header('Content-Type: application/json, charset=utf-8');
79

80
81
82
		if (isset($http_data['v'])) {
			$this->version = intval($http_data['v']);
		}
83
		if ($this->version < 1 || $this->version > 5) {
84
85
86
			return $this->json_error('Invalid version specified.');
		}

87
88
89
90
91
92
		if (!isset($http_data['type']) || !isset($http_data['arg'])) {
			return $this->json_error('No request type/data specified.');
		}
		if (!in_array($http_data['type'], self::$exposed_methods)) {
			return $this->json_error('Incorrect request type specified.');
		}
93
94
95
96
97
98

		if (isset($http_data['search_by']) && !isset($http_data['by'])) {
			$http_data['by'] = $http_data['search_by'];
		}
		if (isset($http_data['by']) && !in_array($http_data['by'], self::$exposed_fields)) {
			return $this->json_error('Incorrect by field specified.');
99
		}
100
101
102

		$this->dbh = DB::connect();

Florian Pritz's avatar
Florian Pritz committed
103
104
105
106
107
		if ($this->check_ratelimit($_SERVER['REMOTE_ADDR'])) {
			header("HTTP/1.1 429 Too Many Requests");
			return $this->json_error('Rate limit reached');
		}

108
		$type = str_replace('-', '_', $http_data['type']);
109
110
111
		if ($type == 'info' && $this->version >= 5) {
			$type = 'multiinfo';
		}
112
		$json = call_user_func(array(&$this, $type), $http_data);
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

		$etag = md5($json);
		header("Etag: \"$etag\"");
		/*
		 * Make sure to strip a few things off the
		 * if-none-match header. Stripping whitespace may not
		 * be required, but removing the quote on the incoming
		 * header is required to make the equality test.
		 */
		$if_none_match = isset($_SERVER['HTTP_IF_NONE_MATCH']) ?
			trim($_SERVER['HTTP_IF_NONE_MATCH'], "\t\n\r\" ") : false;
		if ($if_none_match && $if_none_match == $etag) {
			header('HTTP/1.1 304 Not Modified');
			return;
		}

129
130
		if (isset($http_data['callback'])) {
			$callback = $http_data['callback'];
131
			if (!preg_match('/^[a-zA-Z0-9()_.]{1,128}$/D', $callback)) {
132
133
				return $this->json_error('Invalid callback name.');
			}
134
			header('content-type: text/javascript');
135
			return '/**/' . $callback . '(' . $json . ')';
136
137
138
139
140
141
		} else {
			header('content-type: application/json');
			return $json;
		}
	}

Florian Pritz's avatar
Florian Pritz committed
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
	/*
	 * Check if an IP needs to be  rate limited.
	 *
	 * @param $ip IP of the current request
	 *
	 * @return true if IP needs to be rate limited, false otherwise.
	 */
	private function check_ratelimit($ip) {
		$limit = config_get("ratelimit", "request_limit");
		if ($limit == 0) {
			return false;
		}

		$window_length = config_get("ratelimit", "window_length");
		$this->update_ratelimit($ip);
		$stmt = $this->dbh->prepare("
			SELECT Requests FROM ApiRateLimit
			WHERE IP = :ip");
		$stmt->bindParam(":ip", $ip);
		$result = $stmt->execute();

		if (!$result) {
			return false;
		}

		$row = $stmt->fetch(PDO::FETCH_ASSOC);
		if ($row['Requests'] > $limit) {
			return true;
		}
		return false;
	}

	/*
	 * Update a rate limit for an IP by increasing it's requests value by one.
	 *
	 * @param $ip IP of the current request
	 *
	 * @return void
	 */
	private function update_ratelimit($ip) {
		$window_length = config_get("ratelimit", "window_length");
		$db_backend = config_get("database", "backend");
		$time = time();

		// Clean up old windows
		$deletion_time = $time - $window_length;
		$stmt = $this->dbh->prepare("
			DELETE FROM ApiRateLimit
			WHERE WindowStart < :time");
		$stmt->bindParam(":time", $deletion_time);
		$stmt->execute();

		if ($db_backend == "mysql") {
			$stmt = $this->dbh->prepare("
				INSERT INTO ApiRateLimit
				(IP, Requests, WindowStart)
				VALUES (:ip, 1, :window_start)
				ON DUPLICATE KEY UPDATE Requests=Requests+1");
			$stmt->bindParam(":ip", $ip);
			$stmt->bindParam(":window_start", $time);
			$stmt->execute();
		} elseif ($db_backend == "sqlite") {
			$stmt = $this->dbh->prepare("
				INSERT OR IGNORE INTO ApiRateLimit
				(IP, Requests, WindowStart)
				VALUES (:ip, 0, :window_start);");
			$stmt->bindParam(":ip", $ip);
			$stmt->bindParam(":window_start", $time);
			$stmt->execute();

			$stmt = $this->dbh->prepare("
				UPDATE ApiRateLimit
				SET Requests = Requests + 1
				WHERE IP = :ip");
			$stmt->bindParam(":ip", $ip);
			$stmt->execute();
		} else {
			throw new RuntimeException("Unknown database backend");
		}
	}

223
224
225
226
227
228
229
230
231
	/*
	 * Returns a JSON formatted error string.
	 *
	 * @param $msg The error string to return
	 *
	 * @return mixed A json formatted error response.
	 */
	private function json_error($msg) {
		header('content-type: application/json');
232
233
234
235
236
		if ($this->version < 3) {
			return $this->json_results('error', 0, $msg, NULL);
		} elseif ($this->version >= 3) {
			return $this->json_results('error', 0, array(), $msg);
		}
237
238
239
240
241
242
	}

	/*
	 * Returns a JSON formatted result data.
	 *
	 * @param $type The response method type.
243
	 * @param $count The number of results to return
244
	 * @param $data The result data to return
245
	 * @param $error An error message to include in the response
246
247
248
	 *
	 * @return mixed A json formatted result response.
	 */
249
250
	private function json_results($type, $count, $data, $error) {
		$json_array = array(
251
			'version' => $this->version,
252
253
254
			'type' => $type,
			'resultcount' => $count,
			'results' => $data
255
256
257
258
259
260
261
		);

		if ($error) {
			$json_array['error'] = $error;
		}

		return json_encode($json_array);
262
263
	}

264
265
266
267
	/*
	 * Get extended package details (for info and multiinfo queries).
	 *
	 * @param $pkgid The ID of the package to retrieve details for.
268
	 * @param $base_id The ID of the package base to retrieve details for.
269
270
271
	 *
	 * @return array An array containing package details.
	 */
272
	private function get_extended_fields($pkgid, $base_id) {
273
274
275
276
277
278
279
280
281
282
283
284
285
286
		$query = "SELECT DependencyTypes.Name AS Type, " .
			"PackageDepends.DepName AS Name, " .
			"PackageDepends.DepCondition AS Cond " .
			"FROM PackageDepends " .
			"LEFT JOIN DependencyTypes " .
			"ON DependencyTypes.ID = PackageDepends.DepTypeID " .
			"WHERE PackageDepends.PackageID = " . $pkgid . " " .
			"UNION SELECT RelationTypes.Name AS Type, " .
			"PackageRelations.RelName AS Name, " .
			"PackageRelations.RelCondition AS Cond " .
			"FROM PackageRelations " .
			"LEFT JOIN RelationTypes " .
			"ON RelationTypes.ID = PackageRelations.RelTypeID " .
			"WHERE PackageRelations.PackageID = " . $pkgid . " " .
287
288
			"UNION SELECT 'groups' AS Type, `Groups`.`Name`, '' AS Cond " .
			"FROM `Groups` INNER JOIN PackageGroups " .
289
			"ON PackageGroups.PackageID = " . $pkgid . " " .
290
			"AND PackageGroups.GroupID = `Groups`.ID " .
291
292
293
294
			"UNION SELECT 'license' AS Type, Licenses.Name, '' AS Cond " .
			"FROM Licenses INNER JOIN PackageLicenses " .
			"ON PackageLicenses.PackageID = " . $pkgid . " " .
			"AND PackageLicenses.LicenseID = Licenses.ID";
295
296
		$ttl = config_get_int('options', 'cache_pkginfo_ttl');
		$rows = db_cache_result($query, 'extended-fields:' . $pkgid, PDO::FETCH_ASSOC, $ttl);
297
298
299
300
301
302
303
304
305
306
307
308
309

		$type_map = array(
			'depends' => 'Depends',
			'makedepends' => 'MakeDepends',
			'checkdepends' => 'CheckDepends',
			'optdepends' => 'OptDepends',
			'conflicts' => 'Conflicts',
			'provides' => 'Provides',
			'replaces' => 'Replaces',
			'groups' => 'Groups',
			'license' => 'License',
		);
		$data = array();
310
		foreach ($rows as $row) {
311
312
313
314
			$type = $type_map[$row['Type']];
			$data[$type][] = $row['Name'] . $row['Cond'];
		}

315
316
317
318
		if ($this->version >= 5) {
			$query = "SELECT Keyword FROM PackageKeywords " .
				"WHERE PackageBaseID = " . intval($base_id) . " " .
				"ORDER BY Keyword ASC";
319
320
			$ttl = config_get_int('options', 'cache_pkginfo_ttl');
			$rows = db_cache_result($query, 'keywords:' . intval($base_id), PDO::FETCH_NUM, $ttl);
321
			$data['Keywords'] = array_map(function ($x) { return $x[0]; }, $rows);
322
323
		}

324
325
326
		return $data;
	}

327
328
	/*
	 * Retrieve package information (used in info, multiinfo, search and
329
	 * depends requests).
330
331
332
333
334
335
	 *
	 * @param $type The request type.
	 * @param $where_condition An SQL WHERE-condition to filter packages.
	 *
	 * @return mixed Returns an array of package matches.
	 */
336
	private function process_query($type, $where_condition) {
337
		$max_results = config_get_int('options', 'max_rpc_results');
338
339
340
341
342
343
344
345
346
347
348
349
350

		if ($this->version == 1) {
			$fields = implode(',', self::$fields_v1);
			$query = "SELECT {$fields} " .
				"FROM Packages LEFT JOIN PackageBases " .
				"ON PackageBases.ID = Packages.PackageBaseID " .
				"LEFT JOIN Users " .
				"ON PackageBases.MaintainerUID = Users.ID " .
				"LEFT JOIN PackageLicenses " .
				"ON PackageLicenses.PackageID = Packages.ID " .
				"LEFT JOIN Licenses " .
				"ON Licenses.ID = PackageLicenses.LicenseID " .
				"WHERE ${where_condition} " .
351
				"AND PackageBases.PackagerUID IS NOT NULL " .
352
				"LIMIT $max_results";
353
		} elseif ($this->version >= 2) {
354
355
			if ($this->version == 2 || $this->version == 3) {
				$fields = implode(',', self::$fields_v2);
356
			} else if ($this->version == 4 || $this->version == 5) {
357
358
				$fields = implode(',', self::$fields_v4);
			}
359
360
361
362
363
364
			$query = "SELECT {$fields} " .
				"FROM Packages LEFT JOIN PackageBases " .
				"ON PackageBases.ID = Packages.PackageBaseID " .
				"LEFT JOIN Users " .
				"ON PackageBases.MaintainerUID = Users.ID " .
				"WHERE ${where_condition} " .
365
				"AND PackageBases.PackagerUID IS NOT NULL " .
366
				"LIMIT $max_results";
367
		}
368
369
370
371
372
373
374
		$result = $this->dbh->query($query);

		if ($result) {
			$resultcount = 0;
			$search_data = array();
			while ($row = $result->fetch(PDO::FETCH_ASSOC)) {
				$resultcount++;
375
				$row['URLPath'] = sprintf(config_get('options', 'snapshot_uri'), urlencode($row['PackageBase']));
376
377
378
				if ($this->version < 4) {
					$row['CategoryID'] = 1;
				}
379
380
381
382
383
384
385
386

				/*
				 * Unfortunately, mysql_fetch_assoc() returns
				 * all fields as strings. We need to coerce
				 * numeric values into integers to provide
				 * proper data types in the JSON response.
				 */
				foreach (self::$numeric_fields as $field) {
387
388
389
					if (isset($row[$field])) {
						$row[$field] = intval($row[$field]);
					}
390
391
				}

392
				foreach (self::$decimal_fields as $field) {
393
394
395
					if (isset($row[$field])) {
						$row[$field] = floatval($row[$field]);
					}
396
397
				}

398
				if ($this->version >= 2 && ($type == 'info' || $type == 'multiinfo')) {
399
400
401
402
					$extfields = $this->get_extended_fields($row['ID'], $row['PackageBaseID']);
					if ($extfields) {
						$row = array_merge($row, $extfields);
					}
403
404
				}

405
406
407
408
409
410
411
412
				if ($this->version < 3) {
					if ($type == 'info') {
						$search_data = $row;
						break;
					} else {
						array_push($search_data, $row);
					}
				} elseif ($this->version >= 3) {
413
414
					array_push($search_data, $row);
				}
415
416
			}

417
			if ($resultcount === $max_results) {
418
419
420
				return $this->json_error('Too many package results.');
			}

421
			return $this->json_results($type, $resultcount, $search_data, NULL);
422
		} else {
423
			return $this->json_results($type, 0, array(), NULL);
424
425
426
427
428
429
430
431
432
		}
	}

	/*
	 * Parse the args to the multiinfo function. We may have a string or an
	 * array, so do the appropriate thing. Within the elements, both * package
	 * IDs and package names are valid; sort them into the relevant arrays and
	 * escape/quote the names.
	 *
433
	 * @param array $args Query parameters.
434
435
436
	 *
	 * @return mixed An array containing 'ids' and 'names'.
	 */
437
	private function parse_multiinfo_args($args) {
438
439
440
441
442
443
444
445
446
447
		if (!is_array($args)) {
			$args = array($args);
		}

		$id_args = array();
		$name_args = array();
		foreach ($args as $arg) {
			if (!$arg) {
				continue;
			}
448
			if ($this->version < 5 && is_numeric($arg)) {
449
450
451
452
453
454
455
456
457
458
459
460
				$id_args[] = intval($arg);
			} else {
				$name_args[] = $this->dbh->quote($arg);
			}
		}

		return array('ids' => $id_args, 'names' => $name_args);
	}

	/*
	 * Performs a fulltext mysql search of the package database.
	 *
461
	 * @param array $http_data Query parameters.
462
463
464
	 *
	 * @return mixed Returns an array of package matches.
	 */
465
466
	private function search($http_data) {
		$keyword_string = $http_data['arg'];
467

468
469
		if (isset($http_data['by'])) {
			$search_by = $http_data['by'];
470
471
472
		} else {
			$search_by = 'name-desc';
		}
473

474
475
		if ($search_by === 'name' || $search_by === 'name-desc') {
			if (strlen($keyword_string) < 2) {
476
				return $this->json_error('Query arg too small.');
477
478
			}
			$keyword_string = $this->dbh->quote("%" . addcslashes($keyword_string, '%_') . "%");
479

480
481
482
483
484
485
486
487
488
489
490
491
492
			if ($search_by === 'name') {
				$where_condition = "(Packages.Name LIKE $keyword_string)";
			} else if ($search_by === 'name-desc') {
				$where_condition = "(Packages.Name LIKE $keyword_string OR ";
				$where_condition .= "Description LIKE $keyword_string)";
			}
		} else if ($search_by === 'maintainer') {
			if (empty($keyword_string)) {
				$where_condition = "Users.ID is NULL";
			} else {
				$keyword_string = $this->dbh->quote($keyword_string);
				$where_condition = "Users.Username = $keyword_string ";
			}
493
494
495
496
497
498
499
500
501
502
503
504
505
		} else if (in_array($search_by, self::$exposed_depfields)) {
			if (empty($keyword_string)) {
				return $this->json_error('Query arg is empty.');
			} else {
				$keyword_string = $this->dbh->quote($keyword_string);
				$search_by = $this->dbh->quote($search_by);
				$subquery = "SELECT PackageDepends.DepName FROM PackageDepends ";
				$subquery .= "LEFT JOIN DependencyTypes ";
				$subquery .= "ON PackageDepends.DepTypeID = DependencyTypes.ID ";
				$subquery .= "WHERE PackageDepends.PackageID = Packages.ID ";
				$subquery .= "AND DependencyTypes.Name = $search_by";
				$where_condition = "$keyword_string IN ($subquery)";
			}
506
		}
507
508
509
510
511
512
513

		return $this->process_query('search', $where_condition);
	}

	/*
	 * Returns the info on a specific package.
	 *
514
	 * @param array $http_data Query parameters.
515
516
517
	 *
	 * @return mixed Returns an array of value data containing the package data
	 */
518
519
	private function info($http_data) {
		$pqdata = $http_data['arg'];
520
		if ($this->version < 5 && is_numeric($pqdata)) {
521
522
523
524
525
526
527
528
529
530
531
			$where_condition = "Packages.ID = $pqdata";
		} else {
			$where_condition = "Packages.Name = " . $this->dbh->quote($pqdata);
		}

		return $this->process_query('info', $where_condition);
	}

	/*
	 * Returns the info on multiple packages.
	 *
532
	 * @param array $http_data Query parameters.
533
534
535
	 *
	 * @return mixed Returns an array of results containing the package data
	 */
536
537
	private function multiinfo($http_data) {
		$pqdata = $http_data['arg'];
538
539
540
541
542
		$args = $this->parse_multiinfo_args($pqdata);
		$ids = $args['ids'];
		$names = $args['names'];

		if (!$ids && !$names) {
543
			return $this->json_error('Invalid query arguments.');
544
545
546
547
548
		}

		$where_condition = "";
		if ($ids) {
			$ids_value = implode(',', $args['ids']);
549
			$where_condition .= "Packages.ID IN ($ids_value) ";
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
		}
		if ($ids && $names) {
			$where_condition .= "OR ";
		}
		if ($names) {
			/*
			 * Individual names were quoted in
			 * parse_multiinfo_args().
			 */
			$names_value = implode(',', $args['names']);
			$where_condition .= "Packages.Name IN ($names_value) ";
		}

		return $this->process_query('multiinfo', $where_condition);
	}

	/*
	 * Returns all the packages for a specific maintainer.
	 *
569
	 * @param array $http_data Query parameters.
570
571
572
	 *
	 * @return mixed Returns an array of value data containing the package data
	 */
573
	private function msearch($http_data) {
574
		$http_data['by'] = 'maintainer';
575
		return $this->search($http_data);
576
577
578
579
580
	}

	/*
	 * Get all package names that start with $search.
	 *
581
	 * @param array $http_data Query parameters.
582
583
584
	 *
	 * @return string The JSON formatted response data.
	 */
585
586
	private function suggest($http_data) {
		$search = $http_data['arg'];
587
588
589
590
591
592
593
		$query = "SELECT Packages.Name FROM Packages ";
		$query.= "LEFT JOIN PackageBases ";
		$query.= "ON PackageBases.ID = Packages.PackageBaseID ";
		$query.= "WHERE Packages.Name LIKE ";
		$query.= $this->dbh->quote(addcslashes($search, '%_') . '%');
		$query.= " AND PackageBases.PackagerUID IS NOT NULL ";
		$query.= "ORDER BY Name ASC LIMIT 20";
594
595
596
597
598
599
600
601
602
603

		$result = $this->dbh->query($query);
		$result_array = array();

		if ($result) {
			$result_array = $result->fetchAll(PDO::FETCH_COLUMN, 0);
		}

		return json_encode($result_array);
	}
604
605
606
607

	/*
	 * Get all package base names that start with $search.
	 *
608
	 * @param array $http_data Query parameters.
609
610
611
	 *
	 * @return string The JSON formatted response data.
	 */
612
613
	private function suggest_pkgbase($http_data) {
		$search = $http_data['arg'];
614
615
616
617
		$query = "SELECT Name FROM PackageBases WHERE Name LIKE ";
		$query.= $this->dbh->quote(addcslashes($search, '%_') . '%');
		$query.= " AND PackageBases.PackagerUID IS NOT NULL ";
		$query.= "ORDER BY Name ASC LIMIT 20";
618
619
620
621
622
623
624
625
626
627

		$result = $this->dbh->query($query);
		$result_array = array();

		if ($result) {
			$result_array = $result->fetchAll(PDO::FETCH_COLUMN, 0);
		}

		return json_encode($result_array);
	}
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653

	/**
	 * Get the HTML markup of the comment form.
	 *
	 * @param array $http_data Query parameters.
	 *
	 * @return string The JSON formatted response data.
	 */
	private function get_comment_form($http_data) {
		if (!isset($http_data['base_id']) || !isset($http_data['pkgbase_name'])) {
			$output = array(
				'success' => 0,
				'error' => __('Package base ID or package base name missing.')
			);
			return json_encode($output);
		}

		$comment_id = intval($http_data['arg']);
		$base_id = intval($http_data['base_id']);
		$pkgbase_name = $http_data['pkgbase_name'];

		list($user_id, $comment) = comment_by_id($comment_id);

		if (!has_credential(CRED_COMMENT_EDIT, array($user_id))) {
			$output = array(
				'success' => 0,
654
				'error' => __('You are not allowed to edit this comment.')
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
			);
			return json_encode($output);
		} elseif (is_null($comment)) {
			$output = array(
				'success' => 0,
				'error' => __('Comment does not exist.')
			);
			return json_encode($output);
		}

		ob_start();
		include('pkg_comment_form.php');
		$html = ob_get_clean();
		$output = array(
			'success' => 1,
			'form' => $html
		);

		return json_encode($output);
	}
eliott's avatar
eliott committed
675
}
676