fix: decode double-encoded base64 in plugin/mpm-api-extras.php

plugin/mpm-api-extras.php

@@ -1 +1,135 @@
-PD9waHAKLyoKUGx1Z2luIE5hbWU6ICBNUE0gQVBJIEV4dHJhcwpQbHVnaW4gVVJJOiAgIGh0dHBzOi8vbXBtLnRvCkRlc2NyaXB0aW9uOiAgQWRkcyAnZGVsZXRlJyBhbmQgJ3VwZGF0ZScgYWN0aW9ucyB0byB0aGUgWU9VUkxTIEFQSSBzbyBhbGwgQ1JVRAogICAgICAgICAgICAgIG9wZXJhdGlvbnMgY2FuIGJlIHBlcmZvcm1lZCB1c2luZyB0aGUgc2lnbmF0dXJlIHRva2VuIGFsb25lIOKAlCBubwogICAgICAgICAgICAgIGFkbWluIHVzZXJuYW1lL3Bhc3N3b3JkIHJlcXVpcmVkLgpWZXJzaW9uOiAgICAgIDEuMApBdXRob3I6ICAgICAgIE1lc3NhZ2UgUG9pbnQgTWVkaWEKKi8KCi8vIOKUgOKUgCBSZWdpc3RlciB0aGUgbmV3IGFjdGlvbiBuYW1lcyDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKCnlvdXJsc19hZGRfZmlsdGVyKCAnYXBpX2xpc3RfYWN0aW9ucycsICdtcG1fYXBpX3JlZ2lzdGVyX2FjdGlvbnMnICk7CgpmdW5jdGlvbiBtcG1fYXBpX3JlZ2lzdGVyX2FjdGlvbnMoICRhY3Rpb25zICkgewogICAgJGFjdGlvbnNbXSA9ICdkZWxldGUnOwogICAgJGFjdGlvbnNbXSA9ICd1cGRhdGUnOwogICAgcmV0dXJuICRhY3Rpb25zOwp9CgoKLy8g4pSA4pSAIERFTEVURSDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKLy8gVXNhZ2U6ICBQT1NUIC95b3VybHMtYXBpLnBocAovLyAgIHNpZ25hdHVyZT08dG9rZW4+JmZvcm1hdD1qc29uJmFjdGlvbj1kZWxldGUma2V5d29yZD08Y29kZT4KCmZ1bmN0aW9uIHlvdXJsc19hcGlfYWN0aW9uX2RlbGV0ZSgpIHsKICAgICRrZXl3b3JkID0gaXNzZXQoICRfUkVRVUVTVFsna2V5d29yZCddICkKICAgICAgICA/IHlvdXJsc19zYW5pdGl6ZV9rZXl3b3JkKCAkX1JFUVVFU1RbJ2tleXdvcmQnXSApCiAgICAgICAgOiAnJzsKCiAgICBpZiAoICEgJGtleXdvcmQgKSB7CiAgICAgICAgcmV0dXJuIGFycmF5KAogICAgICAgICAgICAnc3RhdHVzJyAgICA9PiAnZmFpbCcsCiAgICAgICAgICAgICdtZXNzYWdlJyAgID0+ICdNaXNzaW5nIHJlcXVpcmVkIHBhcmFtZXRlcjoga2V5d29yZCcsCiAgICAgICAgICAgICdlcnJvckNvZGUnID0+ICc0MDAnLAogICAgICAgICAgICAnc2ltcGxlJyAgICA9PiAnTWlzc2luZyBrZXl3b3JkJywKICAgICAgICApOwogICAgfQoKICAgIGlmICggISB5b3VybHNfa2V5d29yZF9leGlzdHMoICRrZXl3b3JkICkgKSB7CiAgICAgICAgcmV0dXJuIGFycmF5KAogICAgICAgICAgICAnc3RhdHVzJyAgICA9PiAnZmFpbCcsCiAgICAgICAgICAgICdtZXNzYWdlJyAgID0+ICJTaG9ydCBVUkwgbm90IGZvdW5kOiB7JGtleXdvcmR9IiwKICAgICAgICAgICAgJ2Vycm9yQ29kZScgPT4gJzQwNCcsCiAgICAgICAgICAgICdzaW1wbGUnICAgID0+ICdOb3QgZm91bmQnLAogICAgICAgICk7CiAgICB9CgogICAgJGRlbGV0ZWQgPSB5b3VybHNfZGVsZXRlX2xpbmtfYnlfa2V5d29yZCggJGtleXdvcmQgKTsKCiAgICBpZiAoICRkZWxldGVkICkgewogICAgICAgIHJldHVybiB5b3VybHNfYXBwbHlfZmlsdGVyKCAnYXBpX3Jlc3VsdF9kZWxldGUnLCBhcnJheSgKICAgICAgICAgICAgJ3N0YXR1cycgICAgID0+ICdzdWNjZXNzJywKICAgICAgICAgICAgJ21lc3NhZ2UnICAgID0+ICJTaG9ydCBVUkwgZGVsZXRlZDogeyRrZXl3b3JkfSIsCiAgICAgICAgICAgICdzdGF0dXNDb2RlJyA9PiAnMjAwJywKICAgICAgICAgICAgJ3NpbXBsZScgICAgID0+ICdkZWxldGVkJywKICAgICAgICApICk7CiAgICB9CgogICAgcmV0dXJuIGFycmF5KAogICAgICAgICdzdGF0dXMnICAgID0+ICdmYWlsJywKICAgICAgICAnbWVzc2FnZScgICA9PiAiQ291bGQgbm90IGRlbGV0ZTogeyRrZXl3b3JkfSIsCiAgICAgICAgJ2Vycm9yQ29kZScgPT4gJzUwMCcsCiAgICAgICAgJ3NpbXBsZScgICAgPT4gJ2RlbGV0ZSBmYWlsZWQnLAogICAgKTsKfQoKCi8vIOKUgOKUgCBVUERBVEUg4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSACi8vIFVzYWdlOiAgUE9TVCAveW91cmxzLWFwaS5waHAKLy8gICBzaWduYXR1cmU9PHRva2VuPiZmb3JtYXQ9anNvbiZhY3Rpb249dXBkYXRlJmtleXdvcmQ9PGNvZGU+Ci8vICAgWyZ1cmw9PG5ldy1sb25nLXVybD5dIFsmbmV3a2V5d29yZD08bmV3LWNvZGU+XSBbJnRpdGxlPTxuZXctdGl0bGU+XQovLwovLyBBbnkgY29tYmluYXRpb24gb2YgdXJsIC8gbmV3a2V5d29yZCAvIHRpdGxlIG1heSBiZSBzdXBwbGllZDsgb21pdHRlZCBmaWVsZHMKLy8ga2VlcCB0aGVpciBjdXJyZW50IHZhbHVlcy4KCmZ1bmN0aW9uIHlvdXJsc19hcGlfYWN0aW9uX3VwZGF0ZSgpIHsKICAgICRrZXl3b3JkID0gaXNzZXQoICRfUkVRVUVTVFsna2V5d29yZCddICkKICAgICAgICA/IHlvdXJsc19zYW5pdGl6ZV9rZXl3b3JkKCAkX1JFUVVFU1RbJ2tleXdvcmQnXSApCiAgICAgICAgOiAnJzsKCiAgICBpZiAoICEgJGtleXdvcmQgKSB7CiAgICAgICAgcmV0dXJuIGFycmF5KAogICAgICAgICAgICAnc3RhdHVzJyAgICA9PiAnZmFpbCcsCiAgICAgICAgICAgICdtZXNzYWdlJyAgID0+ICdNaXNzaW5nIHJlcXVpcmVkIHBhcmFtZXRlcjoga2V5d29yZCcsCiAgICAgICAgICAgICdlcnJvckNvZGUnID0+ICc0MDAnLAogICAgICAgICAgICAnc2ltcGxlJyAgICA9PiAnTWlzc2luZyBrZXl3b3JkJywKICAgICAgICApOwogICAgfQoKICAgIC8vIFJlc29sdmUgY3VycmVudCB2YWx1ZXMgZm9yIGFueSBmaWVsZHMgbm90IHN1cHBsaWVkCiAgICAkY3VycmVudF91cmwgICA9IHlvdXJsc19nZXRfa2V5d29yZF9sb25ndXJsKCAka2V5d29yZCApOwogICAgJGN1cnJlbnRfdGl0bGUgPSB5b3VybHNfZ2V0X2tleXdvcmRfdGl0bGUoICRrZXl3b3JkICk7CgogICAgaWYgKCAhICRjdXJyZW50X3VybCApIHsKICAgICAgICByZXR1cm4gYXJyYXkoCiAgICAgICAgICAgICdzdGF0dXMnICAgID0+ICdmYWlsJywKICAgICAgICAgICAgJ21lc3NhZ2UnICAgPT4gIlNob3J0IFVSTCBub3QgZm91bmQ6IHska2V5d29yZH0iLAogICAgICAgICAgICAnZXJyb3JDb2RlJyA9PiAnNDA0JywKICAgICAgICAgICAgJ3NpbXBsZScgICAgPT4gJ05vdCBmb3VuZCcsCiAgICAgICAgKTsKICAgIH0KCiAgICAkbmV3X3VybCAgICAgPSBpc3NldCggJF9SRVFVRVNUWyd1cmwnXSApCiAgICAgICAgPyB5b3VybHNfc2FuaXRpemVfdXJsKCAkX1JFUVVFU1RbJ3VybCddICkKICAgICAgICA6ICRjdXJyZW50X3VybDsKCiAgICAkbmV3X2tleXdvcmQgPSBpc3NldCggJF9SRVFVRVNUWyduZXdrZXl3b3JkJ10gKQogICAgICAgID8geW91cmxzX3Nhbml0aXplX2tleXdvcmQoICRfUkVRVUVTVFsnbmVLine truncated
+<?php
+/*
+Plugin Name:  MPM API Extras
+Plugin URI:   https://mpm.to
+Description:  Adds 'delete' and 'update' actions to the YOURLS API so all CRUD
+              operations can be performed using the signature token alone — no
+              admin username/password required.
+Version:      1.0
+Author:       Message Point Media
+*/
+
+// ── Register the new action names ────────────────────────────────────────────
+
+yourls_add_filter( 'api_list_actions', 'mpm_api_register_actions' );
+
+function mpm_api_register_actions( $actions ) {
+    $actions[] = 'delete';
+    $actions[] = 'update';
+    return $actions;
+}
+
+
+// ── DELETE ────────────────────────────────────────────────────────────────────
+// Usage:  POST /yourls-api.php
+//   signature=<token>&format=json&action=delete&keyword=<code>
+
+function yourls_api_action_delete() {
+    $keyword = isset( $_REQUEST['keyword'] )
+        ? yourls_sanitize_keyword( $_REQUEST['keyword'] )
+        : '';
+
+    if ( ! $keyword ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => 'Missing required parameter: keyword',
+            'errorCode' => '400',
+            'simple'    => 'Missing keyword',
+        );
+    }
+
+    if ( ! yourls_keyword_exists( $keyword ) ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => "Short URL not found: {$keyword}",
+            'errorCode' => '404',
+            'simple'    => 'Not found',
+        );
+    }
+
+    $deleted = yourls_delete_link_by_keyword( $keyword );
+
+    if ( $deleted ) {
+        return yourls_apply_filter( 'api_result_delete', array(
+            'status'     => 'success',
+            'message'    => "Short URL deleted: {$keyword}",
+            'statusCode' => '200',
+            'simple'     => 'deleted',
+        ) );
+    }
+
+    return array(
+        'status'    => 'fail',
+        'message'   => "Could not delete: {$keyword}",
+        'errorCode' => '500',
+        'simple'    => 'delete failed',
+    );
+}
+
+
+// ── UPDATE ────────────────────────────────────────────────────────────────────
+// Usage:  POST /yourls-api.php
+//   signature=<token>&format=json&action=update&keyword=<code>
+//   [&url=<new-long-url>] [&newkeyword=<new-code>] [&title=<new-title>]
+//
+// Any combination of url / newkeyword / title may be supplied; omitted fields
+// keep their current values.
+
+function yourls_api_action_update() {
+    $keyword = isset( $_REQUEST['keyword'] )
+        ? yourls_sanitize_keyword( $_REQUEST['keyword'] )
+        : '';
+
+    if ( ! $keyword ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => 'Missing required parameter: keyword',
+            'errorCode' => '400',
+            'simple'    => 'Missing keyword',
+        );
+    }
+
+    // Resolve current values for any fields not supplied
+    $current_url   = yourls_get_keyword_longurl( $keyword );
+    $current_title = yourls_get_keyword_title( $keyword );
+
+    if ( ! $current_url ) {
+        return array(
+            'status'    => 'fail',
+            'message'   => "Short URL not found: {$keyword}",
+            'errorCode' => '404',
+            'simple'    => 'Not found',
+        );
+    }
+
+    $new_url     = isset( $_REQUEST['url'] )
+        ? yourls_sanitize_url( $_REQUEST['url'] )
+        : $current_url;
+
+    $new_keyword = isset( $_REQUEST['newkeyword'] )
+        ? yourls_sanitize_keyword( $_REQUEST['newkeyword'] )
+        : $keyword;
+
+    $new_title   = isset( $_REQUEST['title'] )
+        ? yourls_sanitize_title( $_REQUEST['title'] )
+        : $current_title;
+
+    $result = yourls_edit_link( $new_url, $keyword, $new_keyword, $new_title );
+
+    if ( isset( $result['status'] ) && $result['status'] === 'success' ) {
+        return yourls_apply_filter( 'api_result_update', array(
+            'status'     => 'success',
+            'message'    => 'Short URL updated',
+            'statusCode' => '200',
+            'shorturl'   => yourls_link( $new_keyword ),
+            'simple'     => yourls_link( $new_keyword ),
+        ) );
+    }
+
+    return array(
+        'status'    => 'fail',
+        'message'   => isset( $result['message'] ) ? $result['message'] : 'Update failed',
+        'errorCode' => '400',
+        'simple'    => 'update failed',
+    );
+}