diff options
| author | Karl 'vollmerk' Vollmer <vollmer@ampache.org> | 2007-12-19 01:36:16 +0000 |
|---|---|---|
| committer | Karl 'vollmerk' Vollmer <vollmer@ampache.org> | 2007-12-19 01:36:16 +0000 |
| commit | 9661434379a94791031604a4a5094f5631351457 (patch) | |
| tree | e9e0b02f6386efad2e1825ce0f3f5a7ec368fe61 | |
| parent | 77bc16f52520efe50ea0664b11f235897239a482 (diff) | |
| download | ampache-9661434379a94791031604a4a5094f5631351457.tar.gz ampache-9661434379a94791031604a4a5094f5631351457.tar.bz2 ampache-9661434379a94791031604a4a5094f5631351457.zip | |
fixed three bugs found by purdyk with the api
| -rw-r--r-- | lib/class/access.class.php | 1 | ||||
| -rw-r--r-- | lib/class/api.class.php | 2 | ||||
| -rw-r--r-- | server/xml.server.php | 2 |
3 files changed, 3 insertions, 2 deletions
diff --git a/lib/class/access.class.php b/lib/class/access.class.php index 2d1ac3e5..462d5e71 100644 --- a/lib/class/access.class.php +++ b/lib/class/access.class.php @@ -191,6 +191,7 @@ class Access { " AND `key` = '$key' AND `level` >= '$level' AND `type`='rpc'"; break; case 'init-api': + $type = 'rpc'; case 'network': case 'interface': case 'stream': diff --git a/lib/class/api.class.php b/lib/class/api.class.php index c7391837..a580bfbe 100644 --- a/lib/class/api.class.php +++ b/lib/class/api.class.php @@ -105,7 +105,7 @@ class Api { $token = md5(uniqid(rand(), true)); $level = Dba::escape($level); $agent = Dba::escape($_SERVER['HTTP_USER_AGENT']); - $expire = time() + Config::('session_length'); + $expire = time() + Config::get('session_length'); $sql = "REPLACE INTO `session_api` (`id`,`user`,`agent`,`level`,`expire`,`ip`) " . "VALUES ('$token','$user_id','$agent','$level','$expire','$ip')"; diff --git a/server/xml.server.php b/server/xml.server.php index d1464dca..10da2e97 100644 --- a/server/xml.server.php +++ b/server/xml.server.php @@ -47,7 +47,7 @@ if (!Config::get('access_control')) { * Verify the existance of the Session they passed in we do allow them to * login via this interface so we do have an exception for action=login */ -if ((!Access::session_exists(array(),$_REQUEST['auth'],'api') AND $_REQUEST['action'] != 'handshake') || !Access::check_network('init-api',$_SERVER['REMOTE_ADDR'],$_REQUEST['user'])) { +if ((!Access::session_exists(array(),$_REQUEST['auth'],'api') AND $_REQUEST['action'] != 'handshake') || !Access::check_network('init-api',$_SERVER['REMOTE_ADDR'],$_REQUEST['user'],'5')) { debug_event('Access Denied','Invalid Session or unathorized access attempt to API','5'); ob_end_clean(); echo xmlData::error('Access Denied due to ACL or unauthorized access attempt to API, attempt logged'); |