adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-06 16:53:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

bug 3055: add security pwg_token on API methods introduced in Piwigo 2.6

Browse Source 
(pwg.groups.addUser, pwg.groups.deleteUser, pwg.groups.setInfo, pwg.users.add,
pwg.users.setInfo, pwg.permissions.add, pwg.permissions.remove)


git-svn-id: http://piwigo.org/svn/branches/2.6@27810 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall
2014-03-17 22:16:47 +00:00
parent 1dd79b4bac
commit 8c8591ccb0
5 changed files with 47 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/ws_functions/pwg.groups.php
+15
View File
@@ -165,6 +165,11 @@ DELETE
*/
function ws_groups_setInfo($params, &$service)
{
if (get_pwg_token() != $params['pwg_token'])
{
return new PwgError(403, 'Invalid security token');
}
$updates = array();
// does the group exist ?
@@ -221,6 +226,11 @@ SELECT COUNT(*)
*/
function ws_groups_addUser($params, &$service)
{
if (get_pwg_token() != $params['pwg_token'])
{
return new PwgError(403, 'Invalid security token');
}
// does the group exist ?
$query = '
SELECT COUNT(*)
@@ -264,6 +274,11 @@ SELECT COUNT(*)
*/
function ws_groups_deleteUser($params, &$service)
{
if (get_pwg_token() != $params['pwg_token'])
{
return new PwgError(403, 'Invalid security token');
}
// does the group exist ?
$query = '
SELECT COUNT(*)