data/bericht
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: photo.php liest Authorization-Header robuster (Apache-kompatibel)
All checks were successful
Deploy bericht / deploy (push) Successful in 1s
Details

Browse source 
Manche Apache-Setups (Prod!) leiten den Authorization-Header nicht
als HTTP_AUTHORIZATION in $_SERVER weiter. Jetzt wird zusätzlich
REDIRECT_HTTP_AUTHORIZATION und apache_request_headers() geprüft.

Fallback: ?jwt=<token> als Query-Param akzeptieren (wird von der
PWA jetzt standardmäßig mitgesendet für <img>-kompatible URLs).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
[deploy]
This commit is contained in:
Eduard Wisch 2026-04-08 23:27:26 +02:00
parent 606ffae1fe
commit 6ae5babc46
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
api/photo.php
View file

@ -34,9 +34,16 @@ require_once __DIR__.'/../lib/bericht.lib.php';
// Support Token via Header ODER Query-String (für <img src> ohne Header) // Support Token via Header ODER Query-String (für <img src> ohne Header)
$token_str = ''; $token_str = '';
$hdr = $_SERVER['HTTP_AUTHORIZATION'] ?? ''; $hdr = $_SERVER['HTTP_AUTHORIZATION'] ?? ($_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '');
if (!$hdr && function_exists('apache_request_headers')) {
$h = apache_request_headers();
foreach ($h as $k => $v) {
if (strcasecmp($k, 'Authorization') === 0) { $hdr = $v; break; }
}
}
if ($hdr && stripos($hdr, 'bearer ') === 0) $token_str = trim(substr($hdr, 7)); if ($hdr && stripos($hdr, 'bearer ') === 0) $token_str = trim(substr($hdr, 7));
if (!$token_str && !empty($_GET['jwt'])) $token_str = (string) $_GET['jwt']; if (!$token_str && !empty($_GET['jwt'])) $token_str = (string) $_GET['jwt'];
if (!$token_str && !empty($_GET['token']) && preg_match('/^[A-Za-z0-9_.-]+$/', $_GET['token'])) $token_str = $_GET['token'];
$payload = $token_str ? bericht_jwt_decode($token_str) : null; $payload = $token_str ? bericht_jwt_decode($token_str) : null;
if (!$payload || empty($payload['sub'])) { if (!$payload || empty($payload['sub'])) {