iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-05-07 22:05:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes #2460 switch api auth header to X-PIWIGO-API

Browse Source 
Replaces usage of the Authorization header with X-PIWIGO-API for API key authentication. This improves consistency and may address issues with standard Authorization header handling.
This commit is contained in:
Linty
2025-12-01 18:12:31 +01:00
parent 66f0ef574d
commit 3da45eabac
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/user.inc.php
+3 -3
View File
@@ -59,12 +59,12 @@ if (isset($_GET['auth']))
// HTTP_AUTHORIZATION api_key // HTTP_AUTHORIZATION api_key
if ( if (
defined('IN_WS') defined('IN_WS')
and isset($_SERVER['HTTP_AUTHORIZATION']) and isset($_SERVER['HTTP_X_PIWIGO_API'])
and !empty($_SERVER['HTTP_AUTHORIZATION']) and !empty($_SERVER['HTTP_X_PIWIGO_API'])
and isset($_REQUEST['method']) and isset($_REQUEST['method'])
) )
{ {
$auth_header = pwg_db_real_escape_string($_SERVER['HTTP_AUTHORIZATION']) ?? null; $auth_header = pwg_db_real_escape_string($_SERVER['HTTP_X_PIWIGO_API']) ?? null;
if ($auth_header) if ($auth_header)
{ {
tools/ws.htm
+1 -1
View File
@@ -125,7 +125,7 @@
<div class="card-content"> <div class="card-content">
<div class="header-setting"> <div class="header-setting">
<p class="header-label">Authorization:</p> <p class="header-label">X-PIWIGO-API:</p>
<p class="header-warning">Doesn't work when you use "INVOKE (new window)"</p> <p class="header-warning">Doesn't work when you use "INVOKE (new window)"</p>
<input type="text" id="apiKey" placeholder="pkid-xxxxxxxx-xxxxxxxxxxxxxxxxxxxx:yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" /> <input type="text" id="apiKey" placeholder="pkid-xxxxxxxx-xxxxxxxxxxxxxxxxxxxx:yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" />
</div> </div>
tools/ws/ws.js
+1 -1
View File
@@ -346,7 +346,7 @@ $(() => {
if (!useCookie) { if (!useCookie) {
fetchOption.credentials = 'omit'; fetchOption.credentials = 'omit';
fetchOption.headers = { fetchOption.headers = {
Authorization: authorization "X-PIWIGO-API": authorization
} }
} }