Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
D
dolibarr
Manage
Activity
Members
Code
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Deploy
Releases
Container Registry
Model registry
Analyze
Contributor analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Software_Artifact_Infrastructure_Repository
dolibarr
Commits
125a34cb
Commit
125a34cb
authored
9 years ago
by
Jean-François Ferry
Browse files
Options
Downloads
Plain Diff
Fix PHPCS
parents
e5f0ab93
d079bc15
No related branches found
Branches containing commit
No related tags found
Tags containing commit
No related merge requests found
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
htdocs/api/class/api_access.class.php
+31
-22
31 additions, 22 deletions
htdocs/api/class/api_access.class.php
htdocs/public/api/index.php
+1
-1
1 addition, 1 deletion
htdocs/public/api/index.php
with
32 additions
and
23 deletions
htdocs/api/class/api_access.class.php
+
31
−
22
View file @
125a34cb
...
...
@@ -28,23 +28,24 @@ use Luracast\Restler\RestException;
class
DolibarrApiAccess
implements
iAuthenticate
{
const
REALM
=
'Restricted Dolibarr API'
;
/**
* @var array $requires role required by API method user / external / admin
* @var array $requires role required by API method user / external / admin
*/
public
static
$requires
=
array
(
'user'
,
'external'
,
'admin'
);
/**
* @var string $role user role
*/
public
static
$role
=
'user'
;
/**
* @var User $user Loggued user
* @var User $user Loggued user
*/
public
static
$user
=
''
;
// @codingStandardsIgnoreStart
/**
* @return string string to be used with WWW-Authenticate header
* @example Basic
...
...
@@ -52,26 +53,27 @@ class DolibarrApiAccess implements iAuthenticate
* @example OAuth
*/
public
function
__getWWWAuthenticateString
();
/**
* Check access
*
*
* @return boolean
*/
public
function
_isAllowed
()
{
// @codingStandardsIgnoreEnd
global
$db
;
$stored_key
=
''
;
$userClass
=
Defaults
::
$userIdentifierClass
;
if
(
isset
(
$_GET
[
'api_key'
]))
{
$sql
=
"SELECT u.login, u.datec, u.api_key, "
;
$sql
.
=
" u.tms as date_modification, u.entity"
;
$sql
.
=
" FROM "
.
MAIN_DB_PREFIX
.
"user as u"
;
$sql
.
=
" WHERE u.api_key = '"
.
$db
->
escape
(
$_GET
[
'api_key'
])
.
"'"
;
if
(
$db
->
query
(
$sql
))
{
if
(
$db
->
num_rows
(
$result
))
...
...
@@ -89,17 +91,17 @@ class DolibarrApiAccess implements iAuthenticate
$userClass
::
setCacheIdentifier
(
$_GET
[
'api_key'
]);
return
false
;
}
$fuser
=
new
User
(
$db
);
if
(
!
$fuser
->
fetch
(
''
,
$login
))
{
throw
new
RestException
(
503
,
'Error when fetching user :'
.
$fuser
->
error
);
}
$fuser
->
getrights
();
static
::
$user
=
$fuser
;
if
(
$fuser
->
societe_id
)
static
::
$role
=
'external'
;
if
(
$fuser
->
admin
)
static
::
$role
=
'admin'
;
}
...
...
@@ -112,12 +114,19 @@ class DolibarrApiAccess implements iAuthenticate
Resources
::
$accessControlFunction
=
'DolibarrApiAccess::verifyAccess'
;
return
in_array
(
static
::
$role
,
(
array
)
static
::
$requires
)
||
static
::
$role
==
'admin'
;
}
// @codingStandardsIgnoreStart
public
function
__getWWWAuthenticateString
()
{
return
''
;
}
// @codingStandardsIgnoreEnd
/**
* Verify access
*
* @param array $m Properties of method
*
*
* @param array $m Properties of method
*
* @access private
*/
public
static
function
verifyAccess
(
array
$m
)
...
...
@@ -125,11 +134,11 @@ class DolibarrApiAccess implements iAuthenticate
$requires
=
isset
(
$m
[
'class'
][
'DolibarrApiAccess'
][
'properties'
][
'requires'
])
?
$m
[
'class'
][
'DolibarrApiAccess'
][
'properties'
][
'requires'
]
:
false
;
return
$requires
?
static
::
$role
==
'admin'
||
in_array
(
static
::
$role
,
(
array
)
$requires
)
:
true
;
}
}
This diff is collapsed.
Click to expand it.
htdocs/public/api/index.php
+
1
−
1
View file @
125a34cb
...
...
@@ -48,7 +48,7 @@ if (empty($conf->global->MAIN_MODULE_API))
}
use
Luracast\Restler\Defaults
;
Defaults
::
setProperty
(
'authenticationMethod'
,
'_isAllowed'
);
$api
=
new
DolibarrApi
(
$db
);
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment