split out the api errors so that it is easier to tell when you should do a new handshake

1 files changed, 10 insertions, 3 deletions

diff --git a/server/xml.server.php b/server/xml.server.php
index 3da772d1..aeae5798 100644
--- a/server/xml.server.php
+++ b/server/xml.server.php
@@ -48,11 +48,18 @@ if (!Config::get('access_control')) {
  * login via this interface so we do have an exception for action=login
  */
 
+if ((!vauth::session_exists('api', $_REQUEST['auth']) AND $_REQUEST['action'] != 'handshake')) { 
+	debug_event('Access Denied','Invalid Session attempt to API [' . $_REQUEST['action'] . ']','5'); 
+	ob_end_clean(); 
+	echo xmlData::error('Session Expired');
+	exit(); 
+} 
+
 
-if ((!vauth::session_exists('api', $_REQUEST['auth']) AND $_REQUEST['action'] != 'handshake') || !Access::check_network('init-api',$_SERVER['REMOTE_ADDR'],$_REQUEST['user'],'5')) { 
-	debug_event('Access Denied','Invalid Session or unathorized access attempt to API [' . $_REQUEST['action'] . ']', '5');
+if (!Access::check_network('init-api',$_SERVER['REMOTE_ADDR'],$_REQUEST['user'],'5')) { 
+	debug_event('Access Denied','Unathorized access attempt to API [' . $_SERVER['REMOTE_ADDR'] . ']', '5');
 	ob_end_clean(); 
-        echo xmlData::error('Access Denied due to ACL or unauthorized access attempt to API, attempt logged');
+        echo xmlData::error('ACL Error');
 	exit(); 
 }