Changeset 585

Timestamp:

Sep 13, 2013, 9:26:31 PM (11 years ago)

Author:

chronos

Message:

• Added: Access to RSS channels restricted to higher level user with API token.

Location:

trunk

Files:

• Modules/News/RSS.php (modified) (1 diff)
• Modules/User/User.php (modified) (1 diff)
• admin/UpdateTrace.php (modified) (2 diffs)
• includes/Version.php (modified) (1 diff)

trunk/Modules/News/RSS.php

@@ -35 +35 @@
           $this->RawPage = true;
           
-          if(array_key_exists($_GET['channel'], $this->System->ModuleManager->Modules['News']->RSSChannels))
+          if(array_key_exists('channel', $_GET)) $ChannelName = $_GET['channel'];
+            else $ChannelName = '';
+          if(array_key_exists('token', $_GET)) $Token = $_GET['token'];
+            else $Token = '';
+          if(array_key_exists($ChannelName, $this->System->ModuleManager->Modules['News']->RSSChannels))
           {
-            $Channel = $this->System->ModuleManager->Modules['News']->RSSChannels[$_GET['channel']];
-            if($this->System->User->Licence($Channel['Permission']))
+            $Channel = $this->System->ModuleManager->Modules['News']->RSSChannels[$ChannelName];            
+            if($this->System->User->Licence($Channel['Permission']) or 
+            $this->System->User->CheckToken($Channel['Permission'], $Token))
             {
             if(is_string($Channel['Callback'][0]))

trunk/Modules/User/User.php

@@ -153 +153 @@
     else return($this->Role >= $Licence);    
   }
+  
+  function CheckToken($Licence, $Token)
+  {
+    $DbResult = $this->System->Database->select('APIToken', 'User', '`Token`="'.$Token.'"');
+    if($DbResult->num_rows > 0)
+    {
+      $DbRow = $DbResult->fetch_assoc();
+      $DbResult2 = $this->System->Database->select('User', 'GM', '`ID`="'.$DbRow['User'].'"');
+      $DbRow2 = $DbResult2->fetch_assoc();
+      return($DbRow2['GM'] >= $Licence);
+    } else return(false);    
+  }
 
   function GetPasswordSalt()

trunk/admin/UpdateTrace.php

@@ -2600 +2600 @@
 }
 
+function UpdateTo585($Manager)
+{ 
+  $Manager->Execute('CREATE TABLE IF NOT EXISTS `APIToken` (
+    `Id` int(11) NOT NULL AUTO_INCREMENT,
+    `User` int(11) NOT NULL,
+    `Token` varchar(255) NOT NULL,
+    PRIMARY KEY (`Id`),
+    KEY `User` (`User`)
+) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;');
+  $Manager->Execute('ALTER TABLE `APIToken`
+  ADD CONSTRAINT `APIToken_ibfk_1` FOREIGN KEY (`User`) REFERENCES `User` (`ID`);');
+}
 
 $Updates = array(
@@ -2610 +2622 @@
         543 => array('Revision' => 567, 'Function' => 'UpdateTo567'),
         567 => array('Revision' => 574, 'Function' => 'UpdateTo574'),
+        574 => array('Revision' => 585, 'Function' => 'UpdateTo585'),
 );

trunk/includes/Version.php

@@ -1 +1 @@
 <?php
 
-$Revision = 584; // Subversion revision
-$DatabaseRevision = 574; // Database structure revision 
-$ReleaseTime = '2013-09-12';
+$Revision = 585; // Subversion revision
+$DatabaseRevision = 585; // Database structure revision 
+$ReleaseTime = '2013-09-13';