Changeset 1710

Timestamp:

08/29/08 22:09:51 (3 months ago)

Author:

vollmerk

Message:

sync to branch

Files:

• branches/3.4/server/xml.server.php (modified) (2 diffs)

branches/3.4/server/xml.server.php

@@ -49 +49 @@
  * login via this interface so we do have an exception for action=login
  */
-if (!Access::check_network('init-api',$_SERVER['REMOTE_ADDR'],$_REQUEST['user'],'5')) { 
-        debug_event('Access Denied','Unathorized access attempt to API [' . $_SERVER['REMOTE_ADDR'] . ']', '3');
-        ob_end_clean(); 
-        echo xmlData::error('403','ACL Error');
-        exit(); 
-}
-
 if ((!vauth::session_exists('api', $_REQUEST['auth']) AND $_REQUEST['action'] != 'handshake')) { 
         debug_event('Access Denied','Invalid Session attempt to API [' . $_REQUEST['action'] . ']','3'); 
@@ -63 +56 @@
 }
 
-// If we make it past the check and we're not a hand-shaking then we should extend the session
-if ($_REQUEST['action'] != 'handshake') { 
+// If the session exists then let's try to pull some data from it to see if we're still allowed to do this
+$session = vauth::get_session_data($_REQUEST['auth']);
+$username = ($_REQUEST['action'] == 'handshake') ? $_REQUEST['user'] : $session['username']; 
+
+if (!Access::check_network('init-api',$_SERVER['REMOTE_ADDR'],$username,'5')) { 
+        debug_event('Access Denied','Unathorized access attempt to API [' . $_SERVER['REMOTE_ADDR'] . ']', '3');
+        ob_end_clean(); 
+        echo xmlData::error('403','ACL Error');
+        exit(); 
+}
+
+if (!$_REQUEST['action'] != 'handshake') { 
         vauth::session_extend($_REQUEST['auth']); 
-        $session = vauth::get_session_data($_REQUEST['auth']);
         $GLOBALS['user'] = User::get_from_username($session['username']);
 } 
+
 
 switch ($_REQUEST['action']) {