wildcard.php bootstraps osTicket through ../main.inc.php, loads include/plugins/api-key-wildcard/api.wildcard.inc.php and api.tickets.php. It defines WildcardTicketApiController as a subclass of TicketApiController whose requireApiKey() delegates to WildcardApiController. It then builds the dispatcher, sends the api signal and resolves the path.
WildcardApiController.requireApiKey() works in this order:
401 Valid API key required.wildcard_getIdByKey(): without a match 401 API key not found or IP not authorized.401 API key not active.0.0.0.0 nor the caller's IP: 401 Source IP not authorized.0.0.0.0 and log_wildcard_access is enabled: debug entry, then the key is returned.The SQL condition of the lookup is:
SELECT id FROM API_KEY_TABLE WHERE apikey = ? AND (ipaddr = ? OR ipaddr = "0.0.0.0")
The standard API in contrast checks only for the exact IP. After the SQL lookup, step 4 is an additional safeguard.
| Class | Responsibility | Important methods |
|---|---|---|
ApiKeyWildcardPlugin |
Plugin class, singleton | bootstrap(), enable(), disable(), performUpdate() (public) |
ApiKeyWildcardConfig |
Configuration fields | getOptions() |
PluginInstaller |
Copy and delete the endpoint file | install() and update() return an array of errors, uninstall() returns bool |
HtaccessManager |
Changes to api/.htaccess |
applyAll() returns an array of errors, addMultiViews(), addWildcardRule(), removeWildcardRule(), removeMultiViews() return bool |
PluginConstants |
Constants (slug, file name, 0.0.0.0, comments, file mode 0755) |
|
WildcardApiController |
API key check with wildcard | requireApiKey() |
WildcardTicketApiController |
Ticket controller using this check (in wildcard.php) |
requireApiKey() |
enable() returns true or an array of errors. disable() always returns true, the results of its individual steps are not evaluated. performUpdate() returns an array with all errors, otherwise true.
On every bootstrap() the plugin reads installed_version from the configuration and compares it with the version in plugin.php using version_compare. If the value is empty or lower, performUpdate() runs: the endpoint file is copied again, api/.htaccess is extended (if it exists) and the new version is stored. On success performUpdate() writes one line to the PHP error log (installation or update). An equal or higher installed version triggers no update.
enable() writes no installation or update log. It writes to the PHP error log only when it creates the singleton instance automatically: [API Key Wildcard] Auto-created singleton instance on success, [API Key Wildcard] Failed to auto-create instance: ... on failure.
api| Signal | Sent by | Purpose |
|---|---|---|
api |
wildcard.php |
Lets other plugins register routes on the dispatcher of the wildcard endpoint. These routes use their own key check. |
The plugin class itself connects to no signal.
Excerpt of the repository. This is not the content of the release ZIP.
osticket-api-key-wildcard/
├── plugin.php # Registration (ID, name, plugin class)
├── class.ApiKeyWildcard.php # Plugin class and configuration
├── class.PluginConstants.php # Constants
├── class.PluginInstaller.php # Copy and delete the endpoint file
├── class.HtaccessManager.php # Changes to api/.htaccess
├── api.wildcard.inc.php # WildcardApiController and helper functions
├── wildcard.php # Endpoint, copied to api/
├── .htaccess # Reference, repository only, not used by the plugin
├── README.md
├── CHANGELOG.md
├── LICENSE
├── .releaseinclude # Files of the release ZIP
├── .gitignore
└── .github/ # CI workflow
According to .releaseinclude the release ZIP contains only *.php, README.md, README-de.md, LICENSE and CHANGELOG.md. The .htaccess is therefore not in the ZIP. The file README-de.md is listed in .releaseinclude but does not exist in the repository.