lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix PHPCS

Browse Source
This commit is contained in:
jfefe 2015-05-12 16:42:35 +02:00
commit 125a34cb34
2 changed files with 32 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
htdocs/api/class/api_access.class.php
View File

@ -28,23 +28,24 @@ use Luracast\Restler\RestException;
class DolibarrApiAccess implements iAuthenticate class DolibarrApiAccess implements iAuthenticate
{ {
const REALM = 'Restricted Dolibarr API'; const REALM = 'Restricted Dolibarr API';
/** /**
* @var array $requires role required by API method user / external / admin * @var array $requires role required by API method user / external / admin
*/ */
public static $requires = array('user','external','admin'); public static $requires = array('user','external','admin');
/** /**
* @var string $role user role * @var string $role user role
*/ */
public static $role = 'user'; public static $role = 'user';
/** /**
* @var User $user Loggued user * @var User $user Loggued user
*/ */
public static $user = ''; public static $user = '';
// @codingStandardsIgnoreStart
/** /**
* @return string string to be used with WWW-Authenticate header * @return string string to be used with WWW-Authenticate header
* @example Basic * @example Basic
@ -52,26 +53,27 @@ class DolibarrApiAccess implements iAuthenticate
* @example OAuth * @example OAuth
*/ */
public function __getWWWAuthenticateString(); public function __getWWWAuthenticateString();
/** /**
* Check access * Check access
* *
* @return boolean * @return boolean
*/ */
public function _isAllowed() public function _isAllowed()
{ {
// @codingStandardsIgnoreEnd
global $db; global $db;
$stored_key = ''; $stored_key = '';
$userClass = Defaults::$userIdentifierClass; $userClass = Defaults::$userIdentifierClass;
if (isset($_GET['api_key'])) { if (isset($_GET['api_key'])) {
$sql = "SELECT u.login, u.datec, u.api_key, "; $sql = "SELECT u.login, u.datec, u.api_key, ";
$sql.= " u.tms as date_modification, u.entity"; $sql.= " u.tms as date_modification, u.entity";
$sql.= " FROM ".MAIN_DB_PREFIX."user as u"; $sql.= " FROM ".MAIN_DB_PREFIX."user as u";
$sql.= " WHERE u.api_key = '".$db->escape($_GET['api_key'])."'"; $sql.= " WHERE u.api_key = '".$db->escape($_GET['api_key'])."'";
if ($db->query($sql)) if ($db->query($sql))
{ {
if ($db->num_rows($result)) if ($db->num_rows($result))
@ -89,17 +91,17 @@ class DolibarrApiAccess implements iAuthenticate
$userClass::setCacheIdentifier($_GET['api_key']); $userClass::setCacheIdentifier($_GET['api_key']);
return false; return false;
} }
$fuser = new User($db); $fuser = new User($db);
if(! $fuser->fetch('',$login)) { if(! $fuser->fetch('',$login)) {
throw new RestException(503, 'Error when fetching user :'.$fuser->error); throw new RestException(503, 'Error when fetching user :'.$fuser->error);
} }
$fuser->getrights(); $fuser->getrights();
static::$user = $fuser; static::$user = $fuser;
if($fuser->societe_id) if($fuser->societe_id)
static::$role = 'external'; static::$role = 'external';
if($fuser->admin) if($fuser->admin)
static::$role = 'admin'; static::$role = 'admin';
} }
@ -112,12 +114,19 @@ class DolibarrApiAccess implements iAuthenticate
Resources::$accessControlFunction = 'DolibarrApiAccess::verifyAccess'; Resources::$accessControlFunction = 'DolibarrApiAccess::verifyAccess';
return in_array(static::$role, (array) static::$requires) || static::$role == 'admin'; return in_array(static::$role, (array) static::$requires) || static::$role == 'admin';
} }
// @codingStandardsIgnoreStart
public function __getWWWAuthenticateString()
{
return '';
}
// @codingStandardsIgnoreEnd
/** /**
* Verify access * Verify access
* *
* @param array $m Properties of method * @param array $m Properties of method
* *
* @access private * @access private
*/ */
public static function verifyAccess(array $m) public static function verifyAccess(array $m)
@ -125,11 +134,11 @@ class DolibarrApiAccess implements iAuthenticate
$requires = isset($m['class']['DolibarrApiAccess']['properties']['requires']) $requires = isset($m['class']['DolibarrApiAccess']['properties']['requires'])
? $m['class']['DolibarrApiAccess']['properties']['requires'] ? $m['class']['DolibarrApiAccess']['properties']['requires']
: false; : false;
return $requires return $requires
? static::$role == 'admin' || in_array(static::$role, (array) $requires) ? static::$role == 'admin' || in_array(static::$role, (array) $requires)
: true; : true;
} }
} }

2
htdocs/public/api/index.php
View File

@ -48,7 +48,7 @@ if (empty($conf->global->MAIN_MODULE_API))
} }
use Luracast\Restler\Defaults; use Luracast\Restler\Defaults;
Defaults::setProperty('authenticationMethod','_isAllowed');
$api = new DolibarrApi($db); $api = new DolibarrApi($db);