960cee4be4
All checks were successful
Deploy bericht / deploy (push) Successful in 14s
- _inc.php: api_authenticate() nutzt awlauth_require(bericht,read) inkl. same-origin-CSRF; CORS (Access-Control-Allow-Origin:*) entfernt (mit Cookies unzulaessig + bei same-origin ueberfluessig). - auth.php: Login ueber awlauth_login/issue -> HttpOnly-Cookie awl_sso, kein Token mehr im Body. - photo.php/pdf.php: GET-Binaer ueber awlauth_verify (kein CSRF, da auch per window.location/<object> geladen); Bearer/jwt-Query-Auth entfernt. - shipments.php: unveraendert (nutzt api_authenticate -> awlauth_require). - neu: logout.php (Single-Logout), verify.php (sliding session). - _jwt.php geloescht (JWT vollstaendig abgeloest). [deploy]
33 lines
1.2 KiB
PHP
33 lines
1.2 KiB
PHP
<?php
|
|
/* POST /api/auth.php — Login über das zentrale SSO-Modul awlauth.
|
|
* Body: { "login": "...", "password": "..." }
|
|
* Setzt bei Erfolg das domainweite HttpOnly-Cookie awl_sso (gilt für alle AWL-Apps).
|
|
* Response: { "ok": true, "user": { id, login, name, admin } } — KEIN Token mehr im Body.
|
|
*/
|
|
require_once __DIR__.'/_inc.php';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') api_fail('POST erforderlich', 405);
|
|
|
|
if (!dol_include_once('/awlauth/lib/awlauth.lib.php') || !function_exists('awlauth_login')) {
|
|
api_fail('SSO-Modul (awlauth) nicht verfügbar', 500);
|
|
}
|
|
|
|
$in = api_input();
|
|
|
|
// Login inkl. Rate-Limit, Passwortprüfung (dol_verifyHash) und Nur-Interne-User-Check
|
|
$r = awlauth_login(trim($in['login'] ?? ''), (string) ($in['password'] ?? ''));
|
|
if (!$r['success']) api_fail($r['error'], $r['http']);
|
|
|
|
$u = $r['user'];
|
|
if (!$u->hasRight('bericht', 'read')) api_fail('Keine Bericht-Rechte', 403);
|
|
|
|
awlauth_issue($u); // HttpOnly-Cookie awl_sso setzen
|
|
|
|
api_ok(array(
|
|
'user' => array(
|
|
'id' => (int) $u->id,
|
|
'login' => $u->login,
|
|
'name' => $u->getFullName($langs ?? null),
|
|
'admin' => (bool) ($u->admin ?? false),
|
|
),
|
|
));
|