Changeset 27810

Timestamp:

Mar 17, 2014, 11:16:47 PM (10 years ago)

Author:

plg

Message:

bug 3055: add security pwg_token on API methods introduced in Piwigo 2.6
(pwg.groups.addUser, pwg.groups.deleteUser, pwg.groups.setInfo, pwg.users.add,
pwg.users.setInfo, pwg.permissions.add, pwg.permissions.remove)

Location:

branches/2.6

Files:

• admin/themes/default/template/user_list.tpl (modified) (6 diffs)
• include/ws_functions/pwg.groups.php (modified) (3 diffs)
• include/ws_functions/pwg.permissions.php (modified) (2 diffs)
• include/ws_functions/pwg.users.php (modified) (2 diffs)
• ws.php (modified) (7 diffs)

branches/2.6/admin/themes/default/template/user_list.tpl

@@ -57 +57 @@
       url: "ws.php?format=json&method=pwg.users.add",
       type:"POST",
-      data: jQuery(this).serialize(),
+      data: jQuery(this).serialize()+"&pwg_token="+pwg_token,
       beforeSend: function() {
         jQuery("#addUserForm .errors").hide();
@@ -346 +346 @@
       type:"POST",
       data: {
+        pwg_token:pwg_token,
         user_id:userId,
         password: jQuery('#user'+userId+' .changePassword input[type=text]').val()
@@ -397 +398 @@
       type:"POST",
       data: {
+        pwg_token:pwg_token,
         user_id:userId,
         username: jQuery('#user'+userId+' .changeUsername input[type=text]').val()
@@ -468 +470 @@
 
     var formData = jQuery('#user'+userId+' form').serialize();
+    formData += '&pwg_token='+pwg_token;
 
     if (jQuery('#user'+userId+' form select[name="group_id[]"] option:selected').length == 0) {
@@ -709 +712 @@
     var method = 'pwg.users.setInfo';
     var data = {
+      pwg_token: pwg_token,
       user_id: selection
     };
@@ -719 +723 @@
         }
         method = 'pwg.users.delete';
-        data.pwg_token = pwg_token;
         break;
       case 'group_associate':

branches/2.6/include/ws_functions/pwg.groups.php

@@ -166 +166 @@
 function ws_groups_setInfo($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   $updates = array();
 
@@ -222 +227 @@
 function ws_groups_addUser($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   // does the group exist ?
   $query = '
@@ -265 +275 @@
 function ws_groups_deleteUser($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   // does the group exist ?
   $query = '

branches/2.6/include/ws_functions/pwg.permissions.php

@@ -147 +147 @@
 function ws_permissions_add($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 
@@ -204 +209 @@
 function ws_permissions_remove($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 

branches/2.6/include/ws_functions/pwg.users.php

@@ -276 +276 @@
 function ws_users_add($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+  
   global $conf;
 
@@ -364 +369 @@
 function ws_users_setInfo($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   global $conf, $user;
 

branches/2.6/ws.php

@@ -773 +773 @@
         'is_default' => array('flags'=>WS_PARAM_OPTIONAL,
                               'type'=>WS_TYPE_BOOL),
+        'pwg_token' => array(),
         ),
       'Updates a group. Leave a field blank to keep the current value.',
@@ -786 +787 @@
         'user_id' =>  array('flags'=>WS_PARAM_FORCE_ARRAY,
                             'type'=>WS_TYPE_ID),
+        'pwg_token' => array(),
         ),
       'Adds one or more users to a group.',
@@ -799 +801 @@
         'user_id' =>  array('flags'=>WS_PARAM_FORCE_ARRAY,
                             'type'=>WS_TYPE_ID),
+        'pwg_token' => array(),
         ),
       'Removes one or more users from a group.',
@@ -851 +854 @@
         'email' =>    array('default'=>null),
         'send_password_by_mail' => array('default'=>false, 'type'=>WS_TYPE_BOOL),
+        'pwg_token' => array(),
         ),
       'Registers a new user.',
@@ -900 +904 @@
         'enabled_high' =>     array('flags'=>WS_PARAM_OPTIONAL,
                                     'type'=>WS_TYPE_BOOL),
+        'pwg_token' => array(),
         ),
       'Updates a user. Leave a field blank to keep the current value.
@@ -937 +942 @@
         'recursive' =>  array('default'=>false,
                               'type'=>WS_TYPE_BOOL),
+        'pwg_token' => array(),
         ),
       'Adds permissions to an album.',
@@ -953 +959 @@
         'user_id' =>  array('flags'=>WS_PARAM_FORCE_ARRAY|WS_PARAM_OPTIONAL,
                             'type'=>WS_TYPE_ID),
+        'pwg_token' => array(),
         ),
       'Removes permissions from an album.',