Remove XML api for security reasons

Author: Jamie Snape

composer.json

@@ -22,7 +22,6 @@
         "maennchen/zipstream-php": "~0.2.2",
         "michelf/php-markdown": "~1.4.1",
         "moontoast/math": "~1.1.0",
-        "pear-pear.php.net/XML_Serializer": "~0.20.2",
         "reprovinci/solr-php-client": "~1.0.3",
         "rhumsaa/uuid": "~2.8.0",
         "sendgrid/sendgrid": "~2.1.1",
@@ -58,12 +57,6 @@
         "core/dao",
         "library"
     ],
-    "repositories": [
-        {
-            "type": "pear",
-            "url": "http://pear.php.net"
-        }
-    ],
     "archive": {
         "exclude": [
             "/core/configs/*.local.*",

core/public/js/upload/upload.revision.js

@@ -111,7 +111,7 @@ midas.upload.revision.initHtml5FileUpload = function () {
     var _streamFileContents = function (uploadToken) {
         var file = files[currentIndex];
         var blob = file.slice(startByte);
-        var url = json.global.webroot + '/api/rest?method=midas.upload.perform&uploadtoken=' +
+        var url = json.global.webroot + '/api/json?method=midas.upload.perform&uploadtoken=' +
             uploadToken + '&length=' + file.size + '&filename=' + encodeURIComponent(file.name);
         var changes = $('#revisionChanges').val();
         if(changes) {

core/public/js/upload/upload.simpleupload.js

@@ -113,7 +113,7 @@ midas.upload.simpleupload.initHtml5FileUpload = function () {
     var _streamFileContents = function (uploadToken) {
         var file = files[currentIndex];
         var blob = file.slice(startByte);
-        var url = json.global.webroot + '/api/rest?method=midas.upload.perform&uploadtoken=' +
+        var url = json.global.webroot + '/api/json?method=midas.upload.perform&uploadtoken=' +
             uploadToken + '&length=' + file.size + '&filename=' + encodeURIComponent(file.name || file.fileName);
 
         resumeUploadId = uploadToken;

modules/api/controllers/IndexController.php

@@ -46,16 +46,14 @@ public function preDispatch()
         $this->apiSetup['apiMethodPrefix'] = $this->Setting->getValueByName(API_METHOD_PREFIX_KEY, $this->moduleName);
 
         $this->action = $actionName = Zend_Controller_Front::getInstance()->getRequest()->getActionName();
-        switch ($this->action) {
-            case "rest":
-            case "json":
-            case "php_serial":
-            case "xmlrpc":
-            case "soap":
-                $this->_initApiCommons();
-                break;
-            default:
-                break;
+
+        if ($this->action === 'json') {
+            $this->disableLayout();
+            $this->_helper->viewRenderer->setNoRender();
+
+            $this->ModuleComponent->Api->controller = &$this;
+            $this->ModuleComponent->Api->apiSetup = &$this->apiSetup;
+            $this->ModuleComponent->Api->userSession = &$this->userSession;
         }
     }
 
@@ -123,57 +121,22 @@ private function _computeApiHelp($apiMethodPrefix)
         }
     }
 
-    /** Initialize property allowing to generate XML */
-    private function _initApiCommons()
-    {
-        // Disable debug information - Required to generate valid XML output
-        // Configure::write('debug', 0);
-
-        $this->disableLayout();
-        $this->_helper->viewRenderer->setNoRender();
-
-        $this->ModuleComponent->Api->controller = &$this;
-        $this->ModuleComponent->Api->apiSetup = &$this->apiSetup;
-        $this->ModuleComponent->Api->userSession = &$this->userSession;
-    }
-
-    /** Controller action handling REST request */
-    public function restAction()
-    {
-        $this->disableLayout();
-        $this->_helper->viewRenderer->setNoRender();
-
-        $method_name = $this->getParam('method');
-        if (!isset($method_name)) {
-            echo 'Inconsistent request: please set a method parameter';
-            exit;
-        }
-
-        $request_data = $this->getAllParams();
-        $this->_computeApiCallback($method_name, $this->apiSetup['apiMethodPrefix']);
-        // Handle XML-RPC request
-        $this->kwWebApiCore = new KwWebApiRestCore($this->apiSetup, $this->apicallbacks, $request_data);
-    }
-
     /** Controller action handling JSON request */
     public function jsonAction()
     {
         $this->disableLayout();
         $this->_helper->viewRenderer->setNoRender();
 
-        $method_name = $this->getParam('method');
-        if (!isset($method_name)) {
+        $methodName = $this->getParam('method');
+
+        if (!isset($methodName)) {
             echo 'Inconsistent request: please set a method parameter';
             exit;
         }
 
-        $request_data = $this->getAllParams();
-        $this->_computeApiCallback($method_name, $this->apiSetup['apiMethodPrefix']);
-        // Handle XML-RPC request
-        $this->kwWebApiCore = new KwWebApiRestCore(
-            $this->apiSetup,
-            $this->apicallbacks,
-            array_merge($request_data, array('format' => 'json'))
-        );
+        $requestData = $this->getAllParams();
+        $apiMethodPrefix = $this->apiSetup['apiMethodPrefix'];
+        $this->_computeApiCallback($methodName, $apiMethodPrefix);
+        $this->kwWebApiCore = new KwWebApiCore($apiMethodPrefix, $this->apicallbacks, $requestData);
     }
 }