login to modx from external/other server revolution 2.2.5

Question

I am pissed off with this problem from 2 days.

I am using MODx Revolution 2.2.5 (traditional) and want to login to modx from external server just to fetch some user details.

1) I know that runprocessor method works only if i am logged in to manager (unfortunately, that's the only way i know to login user in) So i tried IFRAME method to avoid (cross scripting) it worked perfectly but i am not able to read the data from IFRAME using javascript because of same issue, cross domain access policy.

When i try to post data using some other method like CURL, Ajax using

header("Access-Control-Allow-Origin: *"); 

I am able to login (I see $response->response['success'] == 1) but cant access any data and it says

Fatal error: Call to a member function get() on a non-object

Below is the snippet code i am using

if(isset($_POST) && count($_POST)){
    $c = array(
        'username' => $_POST['username'],
        'password' => $_POST['password']
    );
    $response = $modx->runProcessor('security/login',$c);
    if($response->response['success'] == 1){
        $user['id'] = $modx->user->get('id');
                $profile = $modx->user->getOne('Profile');
        $user['fullname'] = $profile->get('fullname');
        $user['email'] = $profile->get('email');
        echo json_encode($user);
    }else{
        echo json_encode($response->response); 
    }
}

2) I can use login snippet but it doesnt return output what i expect. We have ready site and we are already using login plugin so i cant even modify login plugin to respond with expected data

How can i login to modx using api or any other method ??

Answer 1

Well, I sorted out this today, Below is the complete come that worked perfectly. Pay attention to

header("Access-Control-Allow-Origin: http://www.xyz.com");

Using above CORS specification you can allow 2 servers to communication.

header("Access-Control-Allow-Origin: http://www.xyz.com");
if(isset($_POST['username']) && isset($_POST['password'])){

// get username and password from POST array
$username = $modx->sanitizeString($_POST['username']);
$password = $modx->sanitizeString($_POST['password']);
if(trim($username) != "" and trim($password) != ""){
    // Load lexicons to show proper error messages
    if (!isset($modx->lexicon) || !is_object($modx->lexicon)) {
        $modx->getService('lexicon','modLexicon');
    }
    $modx->lexicon->load('login');

    $loginContext= isset ($scriptProperties['login_context']) ? $scriptProperties['login_context'] :
    $modx->context->get('key');

    $addContexts= isset ($scriptProperties['add_contexts']) && !empty($scriptProperties['add_contexts']) ? explode(',', $scriptProperties['add_contexts']) : array();

    $mgrEvents = ($loginContext == 'mgr');

    $givenPassword = $password;

    /** @var $user modUser */
    $user= $modx->getObjectGraph('modUser', '{"Profile":{},"UserSettings":{}}', array ('modUser.username' => $username));

    if (!$user) {
        $ru = $modx->invokeEvent("OnUserNotFound", array(
            'user' => &$user,
            'username' => $username,
            'password' => $password,
            'attributes' => array(
                'loginContext' => $loginContext,
            )
        ));

        if (!empty($ru)) {
            foreach ($ru as $obj) {
                if (is_object($obj) && $obj instanceof modUser) {
                    $user = $obj;
                    break;
                }
            }
        }

        if (!is_object($user) || !($user instanceof modUser)) {
            //echo "cant locate account";
            echo $modx->toJSON($modx->error->failure($modx->lexicon('login_cannot_locate_account')));
            exit;
        }
    }

    if (!$user->get('active')) {
        //echo "inactivated accout";
        echo $modx->toJSON($modx->error->failure($modx->lexicon('login_user_inactive')));
            exit;
        }

    if (!$user->passwordMatches($givenPassword)) {
        if (!array_key_exists('login_failed', $_SESSION)) {
            $_SESSION['login_failed'] = 0;
        }
        if ($_SESSION['login_failed'] == 0) {
            $flc = ((integer) $user->Profile->get('failedlogincount')) + 1;
            $user->Profile->set('failedlogincount', $flc);
            $user->Profile->save();
            $_SESSION['login_failed']++;
        } else {
            $_SESSION['login_failed'] = 0;
        }
        //echo "wrong username pass";
        echo $modx->toJSON($modx->error->failure($modx->lexicon('login_username_password_incorrect')));
            exit;
        }

        $fullname =  $user->Profile->get('fullname');
        echo '{"success":true,"message":"Welcome '.$fullname.'!"}';
 }else{
        echo '{"success":false,"message":"Please enter username and password"}';
 }

}