Changeset 27811 for trunk/include/ws_functions/pwg.permissions.php

Timestamp:

Mar 17, 2014, 11:20:28 PM (10 years ago)

Author:

plg

Message:

merge r27810 from branch 2.6 to trunk

bug 3055: add security pwg_token on API methods introduced in Piwigo 2.6
(pwg.groups.addUser, pwg.groups.deleteUser, pwg.groups.setInfo, pwg.users.add,
pwg.users.setInfo, pwg.permissions.add, pwg.permissions.remove)

File:

• trunk/include/ws_functions/pwg.permissions.php (modified) (2 diffs)

trunk/include/ws_functions/pwg.permissions.php

@@ -147 +147 @@
 function ws_permissions_add($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 
@@ -204 +209 @@
 function ws_permissions_remove($params, &$service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');