yetangitu/ampache
1
0
Fork 0
mirror of https://github.com/Yetangitu/ampache synced 2025-10-04 18:29:40 +02:00
Code Issues Releases Wiki Activity

Clean up API::handshake

Browse source 
Use Access::check_network to check the ACLs. Be more restrictive about
validating timestamps.  Miscellaneous cleanup (line wraps, etc.)
This commit is contained in:
Paul Arthur 2011-05-26 18:35:30 -04:00
parent 830a739c89
commit 7c491ec1c7
2 changed files with 37 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/CHANGELOG
View file

@ -4,6 +4,7 @@
-------------------------------------------------------------------------- --------------------------------------------------------------------------
v.3.6-Alpha2 v.3.6-Alpha2
- API handshake code cleanup, including a bugfix from postfuturist
- Improved install process when JavaScript is disabled - Improved install process when JavaScript is disabled
- Updated getID3 to 1.8.5 - Updated getID3 to 1.8.5
- Fixed duplicate searching even more - Fixed duplicate searching even more

78
lib/class/api.class.php
View file

@ -115,80 +115,69 @@ class Api {
/** /**
* handshake * handshake
* This is the function that handles the verifying a new handshake *
* this takes a timestamp, auth key, and client IP. Optionally it * This is the function that handles verifying a new handshake
* can take a username, if non is passed the ACL must be non-use * Takes a timestamp, auth key, and username.
* specific
*/ */
public static function handshake($input) { public static function handshake($input) {
$timestamp = $input['timestamp']; $timestamp = preg_replace('/[^0-9]/', '', $input['timestamp']);
$passphrase = $input['auth']; $passphrase = $input['auth'];
$ip = $_SERVER['REMOTE_ADDR']; $ip = $_SERVER['REMOTE_ADDR'];
$username = $input['user']; $username = $input['user'];
$version = $input['version']; $version = $input['version'];
// Let them know we're attempting // Log the attempt
debug_event('API',"Attempting Handshake IP:$ip User:$username Version:$version",'5'); debug_event('API', "Handshake Attempt, IP:$ip User:$username Version:$version", 5);
if (intval($version) < self::$version) { if (intval($version) < self::$version) {
debug_event('API','Login Failed version too old','1'); debug_event('API', 'Login Failed: version too old', 1);
Error::add('api','Login Failed version too old'); Error::add('api', 'Login Failed: version too old');
return false; return false;
} }
// If the timestamp is over 2hr old sucks to be them // If the timestamp isn't within 30 minutes sucks to be them
if ($timestamp < (time() - 14400)) { if (($timestamp < (time() - 1800)) ||
debug_event('API','Login Failed, timestamp too old','1'); ($timestamp > (time() + 1800))) {
Error::add('api','Login Failed, timestamp too old'); debug_event('API', 'Login Failed: timestamp out of range', 1);
Error::add('api', 'Login Failed: timestamp out of range');
return false; return false;
} }
// First we'll filter by username and IP // Grab the correct userid
// FIXME: Does this if/else make sense with the new ACLs?
if (!trim($username)) { if (!trim($username)) {
$user_id = '-1'; $user_id = '-1';
} }
else { else {
$client = User::get_from_username($username); $client = User::get_from_username($username);
$user_id =$client->id; $user_id = $client->id;
} }
// Clean incomming variables
$user_id = Dba::escape($user_id); $user_id = Dba::escape($user_id);
$timestamp = preg_replace('/[^0-9]/', '', $timestamp);
$ip = inet_pton($ip);
// Log this attempt // Log this attempt
debug_event('API','Login Attempt, IP:' . inet_ntop($ip) . ' Time:' . $timestamp . ' User:' . $username . '(' . $user_id . ') Auth:' . $passphrase,'1'); debug_event('API', "Login Attempt, IP:$ip Time: $timestamp User:$username ($user_id) Auth:$passphrase", 1);
$ip = Dba::escape($ip); if (Access::check_network('api', $user_id, 5, $ip)) {
// Now we're sure that there is an ACL line that matches
// Run the query and return the passphrases as we'll have to mangle them // this user or ALL USERS, pull the user's password and
// to figure out if they match what we've got // then see what we come out with
$sql = "SELECT * FROM `access_list` " . $sql = "SELECT * FROM `user` WHERE `id`='$user_id'";
"WHERE `type`='rpc' AND (`user`='$user_id' OR `access_list`.`user`='-1') " .
"AND `start` <= '$ip' AND `end` >= '$ip'";
$db_results = Dba::read($sql); $db_results = Dba::read($sql);
while ($row = Dba::fetch_assoc($db_results)) { $row = Dba::fetch_assoc($db_results);
// Now we're sure that there is an ACL line that matches this user or ALL USERS,
// pull the users password and then see what we come out with
$sql = "SELECT * FROM `user` WHERE `id`='$user_id'";
$user_results = Dba::read($sql);
$row = Dba::fetch_assoc($user_results);
if (!$row['password']) { if (!$row['password']) {
debug_event('API','Unable to find user with username of ' . $user_id,'1'); debug_event('API', 'Unable to find user with userid of ' . $user_id, 1);
Error::add('api','Invalid Username/Password'); Error::add('api','Invalid Username/Password');
return false; return false;
} }
$sha1pass = hash('sha256',$timestamp . $row['password']); $sha1pass = hash('sha256', $timestamp . $row['password']);
if ($sha1pass === $passphrase) { if ($sha1pass === $passphrase) {
// Create the Session, in this class for now needs to be moved // Create the session
// FIXME: needs to be moved to the correct class
$data['username'] = $client->username; $data['username'] = $client->username;
$data['type'] = 'api'; $data['type'] = 'api';
$data['value'] = $timestamp; $data['value'] = $timestamp;
@ -196,16 +185,19 @@ class Api {
// Insert the token into the streamer // Insert the token into the streamer
Stream::insert_session($token,$client->id); Stream::insert_session($token,$client->id);
debug_event('API','Login Success, passphrase matched','1'); debug_event('API', 'Login Success, passphrase matched', 1);
// We need to also get the 'last update' of the catalog information in an RFC 2822 Format // We need to also get the 'last update' of the
// catalog information in an RFC 2822 Format
$sql = "SELECT MAX(`last_update`) AS `update`,MAX(`last_add`) AS `add`, MAX(`last_clean`) AS `clean` FROM `catalog`"; $sql = "SELECT MAX(`last_update`) AS `update`,MAX(`last_add`) AS `add`, MAX(`last_clean`) AS `clean` FROM `catalog`";
$db_results = Dba::read($sql); $db_results = Dba::read($sql);
$row = Dba::fetch_assoc($db_results); $row = Dba::fetch_assoc($db_results);
// Now we need to quickly get the totals of songs // Now we need to quickly get the song totals
$sql = "SELECT COUNT(`id`) AS `song`,COUNT(DISTINCT(`album`)) AS `album`," . $sql = 'SELECT COUNT(`id`) AS `song`, ' .
"COUNT(DISTINCT(`artist`)) AS `artist` FROM `song`"; 'COUNT(DISTINCT(`album`)) AS `album`, '.
'COUNT(DISTINCT(`artist`)) AS `artist` ' .
'FROM `song`';
$db_results = Dba::read($sql); $db_results = Dba::read($sql);
$counts = Dba::fetch_assoc($db_results); $counts = Dba::fetch_assoc($db_results);