960cee4be4
All checks were successful
Deploy bericht / deploy (push) Successful in 14s
- _inc.php: api_authenticate() nutzt awlauth_require(bericht,read) inkl. same-origin-CSRF; CORS (Access-Control-Allow-Origin:*) entfernt (mit Cookies unzulaessig + bei same-origin ueberfluessig). - auth.php: Login ueber awlauth_login/issue -> HttpOnly-Cookie awl_sso, kein Token mehr im Body. - photo.php/pdf.php: GET-Binaer ueber awlauth_verify (kein CSRF, da auch per window.location/<object> geladen); Bearer/jwt-Query-Auth entfernt. - shipments.php: unveraendert (nutzt api_authenticate -> awlauth_require). - neu: logout.php (Single-Logout), verify.php (sliding session). - _jwt.php geloescht (JWT vollstaendig abgeloest). [deploy]
77 lines
3.2 KiB
PHP
77 lines
3.2 KiB
PHP
<?php
|
|
/* Gemeinsamer API-Init für alle Bericht-API-Endpoints.
|
|
*
|
|
* - Lädt Dolibarr ohne Login (NOLOGIN), Auth per awl_sso-Cookie (zentrales SSO-Modul awlauth)
|
|
* - JSON Request/Response Helpers
|
|
* - Authentifiziert per awlauth_require (außer auth.php)
|
|
*/
|
|
|
|
if (!defined('NOLOGIN')) define('NOLOGIN', '1');
|
|
if (!defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1');
|
|
if (!defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1');
|
|
if (!defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1');
|
|
if (!defined('NOREQUIREHTML')) define('NOREQUIREHTML', '1');
|
|
if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1');
|
|
|
|
$res = 0;
|
|
if (!$res && !empty($_SERVER["CONTEXT_DOCUMENT_ROOT"])) $res = @include $_SERVER["CONTEXT_DOCUMENT_ROOT"]."/main.inc.php";
|
|
$tmp = empty($_SERVER['SCRIPT_FILENAME']) ? '' : $_SERVER['SCRIPT_FILENAME']; $tmp2 = realpath(__FILE__); $i = strlen($tmp) - 1; $j = strlen($tmp2) - 1;
|
|
while ($i > 0 && $j > 0 && isset($tmp[$i]) && isset($tmp2[$j]) && $tmp[$i] == $tmp2[$j]) { $i--; $j--; }
|
|
if (!$res && $i > 0 && file_exists(substr($tmp, 0, ($i + 1))."/main.inc.php")) $res = @include substr($tmp, 0, ($i + 1))."/main.inc.php";
|
|
if (!$res && $i > 0 && file_exists(dirname(substr($tmp, 0, ($i + 1)))."/main.inc.php")) $res = @include dirname(substr($tmp, 0, ($i + 1)))."/main.inc.php";
|
|
if (!$res && file_exists("../../main.inc.php")) $res = @include "../../main.inc.php";
|
|
if (!$res && file_exists("../../../main.inc.php")) $res = @include "../../../main.inc.php";
|
|
if (!$res) die("Include of main fails");
|
|
|
|
require_once __DIR__.'/../class/bericht.class.php';
|
|
require_once __DIR__.'/../lib/bericht.lib.php';
|
|
|
|
// Same-Origin: PWA (/baustelle/) und API (/custom/bericht/api/) laufen auf derselben Domain.
|
|
// Deshalb KEIN CORS mehr (Access-Control-Allow-Origin: * ist mit Cookies ohnehin unzulaessig).
|
|
// Das HttpOnly-Cookie awl_sso wird per credentials:'same-origin' automatisch mitgeschickt.
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
|
|
function api_send($data, $code = 200)
|
|
{
|
|
http_response_code($code);
|
|
echo json_encode($data, JSON_UNESCAPED_UNICODE);
|
|
exit;
|
|
}
|
|
|
|
function api_fail($msg, $code = 400)
|
|
{
|
|
api_send(array('error' => $msg), $code);
|
|
}
|
|
|
|
function api_ok($data = array())
|
|
{
|
|
api_send(array_merge(array('ok' => true), $data));
|
|
}
|
|
|
|
function api_input()
|
|
{
|
|
$body = file_get_contents('php://input');
|
|
if (!$body) return $_POST;
|
|
$json = json_decode($body, true);
|
|
return is_array($json) ? $json : $_POST;
|
|
}
|
|
|
|
/**
|
|
* Authentifiziert den Request über das zentrale SSO-Cookie awl_sso.
|
|
* awlauth_require prüft Cookie-Signatur, same-origin-Herkunft (CSRF) und die
|
|
* Berechtigung; bei Fehler beendet es selbst mit 401/403. Der zurückgegebene
|
|
* User ist voll geladen (inkl. Rechte) — die granularen hasRight('bericht',...)-
|
|
* Checks in den Endpoints bleiben dadurch unverändert gültig.
|
|
*/
|
|
function api_authenticate($db_param = null)
|
|
{
|
|
global $db, $user, $conf;
|
|
if ($db_param) $db = $db_param;
|
|
|
|
if (!dol_include_once('/awlauth/lib/awlauth.lib.php') || !function_exists('awlauth_require')) {
|
|
api_fail('SSO-Modul (awlauth) nicht verfügbar', 500);
|
|
}
|
|
$user = awlauth_require('bericht', 'read'); // CSRF + 401/403 + exit inklusive
|
|
return $user;
|
|
}
|