lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Allow HTTP POST request for login API method.

Browse Source 
This is more secure than do the request with sensitive value like password into URL parameters.
This commit is contained in:
jfefe 2016-11-22 23:44:10 +01:00
parent 3830c405a8
commit b436df3202
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
htdocs/api/class/api_generic.class.php
View File

@ -45,11 +45,14 @@ class GenericApi extends DolibarrApi
* @return array Response status and user token * @return array Response status and user token
* *
* @throws RestException * @throws RestException
*
* @url POST /login
* @url GET /login
*/ */
public function login($login, $password, $entity=0, $reset=0) { public function login($login, $password, $entity=0, $reset=0) {
global $conf, $dolibarr_main_authentication, $dolibarr_auto_user; global $conf, $dolibarr_main_authentication, $dolibarr_auto_user;
// Authentication mode // Authentication mode
if (empty($dolibarr_main_authentication)) if (empty($dolibarr_main_authentication))
$dolibarr_main_authentication = 'http,dolibarr'; $dolibarr_main_authentication = 'http,dolibarr';
@ -67,21 +70,21 @@ class GenericApi extends DolibarrApi
} }
$token = 'failedtogenerateorgettoken'; $token = 'failedtogenerateorgettoken';
$tmpuser=new User($this->db); $tmpuser=new User($this->db);
$tmpuser->fetch(0, $login); $tmpuser->fetch(0, $login);
// Renew the hash // Renew the hash
if (empty($tmpuser->api_key) || $reset) if (empty($tmpuser->api_key) || $reset)
{ {
// Generate token for user // Generate token for user
$token = dol_hash($login.uniqid().$conf->global->MAIN_API_KEY,1); $token = dol_hash($login.uniqid().$conf->global->MAIN_API_KEY,1);
// We store API token into database // We store API token into database
$sql = "UPDATE ".MAIN_DB_PREFIX."user"; $sql = "UPDATE ".MAIN_DB_PREFIX."user";
$sql.= " SET api_key = '".$this->db->escape($token)."'"; $sql.= " SET api_key = '".$this->db->escape($token)."'";
$sql.= " WHERE login = '".$this->db->escape($login)."'"; $sql.= " WHERE login = '".$this->db->escape($login)."'";
dol_syslog(get_class($this)."::login", LOG_DEBUG); // No log dol_syslog(get_class($this)."::login", LOG_DEBUG); // No log
$result = $this->db->query($sql); $result = $this->db->query($sql);
if (!$result) if (!$result)
@ -93,7 +96,7 @@ class GenericApi extends DolibarrApi
{ {
$token = $tmpuser->api_key; $token = $tmpuser->api_key;
} }
//return token //return token
return array( return array(
'success' => array( 'success' => array(