Changeset 27810 for branches/2.6/include/ws_functions

Timestamp:

Mar 17, 2014, 11:16:47 PM (10 years ago)

Author:

plg

Message:

bug 3055: add security pwg_token on API methods introduced in Piwigo 2.6
(pwg.groups.addUser, pwg.groups.deleteUser, pwg.groups.setInfo, pwg.users.add,
pwg.users.setInfo, pwg.permissions.add, pwg.permissions.remove)

Location:

branches/2.6/include/ws_functions

Files:

• pwg.groups.php (modified) (3 diffs)
• pwg.permissions.php (modified) (2 diffs)
• pwg.users.php (modified) (2 diffs)

branches/2.6/include/ws_functions/pwg.groups.php

@@ -166 +166 @@
 function ws_groups_setInfo($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   $updates = array();
 
@@ -222 +227 @@
 function ws_groups_addUser($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   // does the group exist ?
   $query = '
@@ -265 +275 @@
 function ws_groups_deleteUser($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   // does the group exist ?
   $query = '

branches/2.6/include/ws_functions/pwg.permissions.php

@@ -147 +147 @@
 function ws_permissions_add($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 
@@ -204 +209 @@
 function ws_permissions_remove($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 

branches/2.6/include/ws_functions/pwg.users.php

@@ -276 +276 @@
 function ws_users_add($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+  
   global $conf;
 
@@ -364 +369 @@
 function ws_users_setInfo($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   global $conf, $user;