From 2b99e1aabdad1e94ec20e49dd61aa7abc074ed68 Mon Sep 17 00:00:00 2001 From: plegall Date: Fri, 5 Mar 2021 16:37:16 +0100 Subject: [PATCH] (cp 917c733) fixes #1344 add auth exception for pwg.images.uploadAsync This method handles its own authentication and can be called by an anonymous request. Thus it should not be blocked by a $conf[guest_access] setting set to false. --- include/ws_functions.inc.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/ws_functions.inc.php b/include/ws_functions.inc.php index d2b5537ed..de4acc6ea 100644 --- a/include/ws_functions.inc.php +++ b/include/ws_functions.inc.php @@ -20,7 +20,8 @@ function ws_isInvokeAllowed($res, $methodName, $params) } if ( !is_autorize_status(ACCESS_GUEST) and - strpos($methodName,'pwg.session.')!==0 ) + strpos($methodName,'pwg.session.')!==0 and + 'pwg.images.uploadAsync'!=$methodName ) { return new PwgError(401, 'Access denied'); }