Changeset 27810 for branches/2.6/include/ws_functions/pwg.users.php

Timestamp:

Mar 17, 2014, 11:16:47 PM (10 years ago)

Author:

plg

Message:

bug 3055: add security pwg_token on API methods introduced in Piwigo 2.6
(pwg.groups.addUser, pwg.groups.deleteUser, pwg.groups.setInfo, pwg.users.add,
pwg.users.setInfo, pwg.permissions.add, pwg.permissions.remove)

File:

• branches/2.6/include/ws_functions/pwg.users.php (modified) (2 diffs)

branches/2.6/include/ws_functions/pwg.users.php

@@ -276 +276 @@
 function ws_users_add($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+  
   global $conf;
 
@@ -364 +369 @@
 function ws_users_setInfo($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   global $conf, $user;