Changed from GET to POST on all parameter passing. Fixed a nasty bug in previous...

[hermes] / api / user.php

diff --git a/api/user.php b/api/user.php
index a601d77fbff1ce9dbffc2436c5f0de0373e0cf2f..c5926bcfe3992e14a940c3a4d874f5680c858640 100644 (file)
--- a/api/user.php
+++ b/api/user.php
@@ -29,19 +29,19 @@ token_auth();
                        // user: authentication username, SIP-username without domain component
                        // domain: Domain/realm of the user. username + '@' + domain == SIP address.
 
-                       if ( array_key_exists('user', $_GET) ||
-                               ( array_key_exists('username', $_GET) && array_key_exists('domain', $_GET )))
+                       if ( array_key_exists('user', $_POST) ||
+                               ( array_key_exists('username', $_POST) && array_key_exists('domain', $_POST )))
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );
@@ -87,8 +87,8 @@ token_auth();
                           * SQL SELECT CONCAT() WHERE CONCAT() must be used *shrug*
                           */
                        $search = null;
-                       if ( array_key_exists ( 'search', $_GET ) ) 
-                               $search = $_GET['search']; // TODO: Add some sanitation and input validation!
+                       if ( array_key_exists ( 'search', $_POST ) ) 
+                               $search = $_POST['search']; // TODO: Add some sanitation and input validation!
                        $list = list_users( $search );
                        print json_encode( array( 'response' => 'ok', 'list' => $list ));
                        break;
@@ -124,20 +124,20 @@ token_auth();
                        */
                        // Test required parameters:
                        if ( 
-                               ( ( array_key_exists( 'username', $_GET) && array_key_exists( 'domain', $_GET ) ) || array_key_exists('user', $_GET) )
-                               && array_key_exists( 'displayname', $_GET ) 
-                               && array_key_exists( 'email', $_GET ) )
+                               ( ( array_key_exists( 'username', $_POST) && array_key_exists( 'domain', $_POST ) ) || array_key_exists('user', $_POST) )
+                               && array_key_exists( 'displayname', $_POST ) 
+                               && array_key_exists( 'email', $_POST ) )
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );
@@ -147,8 +147,8 @@ token_auth();
                                }
 
                                $password = generate_password();
-                               $displayname = $_GET['displayname'];
-                               $email = $_GET['email'];
+                               $displayname = $_POST['displayname'];
+                               $email = $_POST['email'];
 
                                if (  !is_kamailio_domain( $domain ) )
                                {
@@ -257,21 +257,21 @@ token_auth();
 
                        // Test required parameters:
                        if ( 
-                               ( ( array_key_exists( 'username', $_GET) && array_key_exists( 'domain', $_GET ) ) || array_key_exists('user', $_GET) )
-                               && array_key_exists( 'displayname', $_GET )
-                               && array_key_exists( 'password', $_GET )
-                               && array_key_exists( 'registrar', $_GET ) )
+                               ( ( array_key_exists( 'username', $_POST) && array_key_exists( 'domain', $_POST ) ) || array_key_exists('user', $_POST) )
+                               && array_key_exists( 'displayname', $_POST )
+                               && array_key_exists( 'password', $_POST )
+                               && array_key_exists( 'registrar', $_POST ) )
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );
@@ -280,16 +280,16 @@ token_auth();
                                        list ( $username, $domain ) = $user;
                                }
 
-                               $password = $_GET['password'];
-                               $displayname = $_GET['displayname'];
-                               $registrar = $_GET['registrar'];
-                               $r_port = ( array_key_exists('r_port', $_GET) ) ? $_GET['r_port'] : 5060;
+                               $password = $_POST['password'];
+                               $displayname = $_POST['displayname'];
+                               $registrar = $_POST['registrar'];
+                               $r_port = ( array_key_exists('r_port', $_POST) ) ? $_POST['r_port'] : 5060;
 
-                               $proxy = ( array_key_exists('proxy', $_GET) ) ? $_GET['proxy'] : $registrar;
-                               $p_port = ( array_key_exists('p_port', $_GET) ) ? $_GET['p_port'] : $r_port;
-                               $authid = ( array_key_exists('authid', $_GET) ) ? $_GET['authid'] : $username;
-                               $dialplan = ( array_key_exists('dialplan', $_GET) ) ? $_GET['dialplan'] : $config['standard_dialplan'];
-                               $linetext = ( array_key_exists('linetext', $_GET) ) ? $_GET['linetext'] : $username . '@' . $domain;
+                               $proxy = ( array_key_exists('proxy', $_POST) ) ? $_POST['proxy'] : $registrar;
+                               $p_port = ( array_key_exists('p_port', $_POST) ) ? $_POST['p_port'] : $r_port;
+                               $authid = ( array_key_exists('authid', $_POST) ) ? $_POST['authid'] : $username;
+                               $dialplan = ( array_key_exists('dialplan', $_POST) ) ? $_POST['dialplan'] : $config['standard_dialplan'];
+                               $linetext = ( array_key_exists('linetext', $_POST) ) ? $_POST['linetext'] : $username . '@' . $domain;
 
                                if ( is_kamailio_domain( $domain ) )
                                {
@@ -354,20 +354,20 @@ token_auth();
                        * If no such user exists, return 'response' => 'failed' with 'cause' => 'nonexistant'
                        * On other failures, return 'response' => 'failed' with 'cause' => 'error' (may set 'detail' => 'message')
                        */
-                       if ( ( array_key_exists( 'username', $_GET) && array_key_exists( 'domain', $_GET ) ) 
-                               || array_key_exists('user', $_GET) )
+                       if ( ( array_key_exists( 'username', $_POST) && array_key_exists( 'domain', $_POST ) ) 
+                               || array_key_exists('user', $_POST) )
 
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );
@@ -413,21 +413,21 @@ token_auth();
                        * Update user passwords in 'provision' and 'kamailio' as appropriate
                        * On other failures, return 'response' => 'failed' with 'cause' => 'error' (may set 'detail' => 'message')
                        */
-                       if (    array_key_exists('password', $_GET) &&
-                               ( ( array_key_exists( 'username', $_GET) && array_key_exists( 'domain', $_GET ) ) 
-                                       || array_key_exists('user', $_GET) ))
+                       if (    array_key_exists('password', $_POST) &&
+                               ( ( array_key_exists( 'username', $_POST) && array_key_exists( 'domain', $_POST ) ) 
+                                       || array_key_exists('user', $_POST) ))
 
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );
@@ -435,7 +435,7 @@ token_auth();
                                        }
                                        list ( $username, $domain ) = $user;
                                }
-                               $password = $_GET['password'];
+                               $password = $_POST['password'];
 
                                // Check compatibility of password? TODO...
                                // Fetch old password for rollback? TODO...
@@ -478,21 +478,21 @@ token_auth();
                                ( username & domain ) | user
                                email
                        */
-                       if (    array_key_exists('email', $_GET) &&
-                               ( ( array_key_exists( 'username', $_GET) && array_key_exists( 'domain', $_GET ) ) 
-                                       || array_key_exists('user', $_GET) ))
+                       if (    array_key_exists('email', $_POST) &&
+                               ( ( array_key_exists( 'username', $_POST) && array_key_exists( 'domain', $_POST ) ) 
+                                       || array_key_exists('user', $_POST) ))
 
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );
@@ -500,7 +500,7 @@ token_auth();
                                        }
                                        list ( $username, $domain ) = $user;
                                }
-                               $email = $_GET['email'];
+                               $email = $_POST['email'];
 
                                // Check for user in kamailio
                                if ( is_kamailio_subscriber( $username, $domain ) )
@@ -538,20 +538,20 @@ token_auth();
                        * Get update parameters, and change as appropriate ;)
                        * On other failures, return 'response' => 'failed' with 'cause' => 'error' (may set 'detail' => 'message')
                        */
-                       if ( ( array_key_exists( 'username', $_GET) && array_key_exists( 'domain', $_GET ) ) 
-                               || array_key_exists('user', $_GET) )
+                       if ( ( array_key_exists( 'username', $_POST) && array_key_exists( 'domain', $_POST ) ) 
+                               || array_key_exists('user', $_POST) )
 
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );
@@ -571,9 +571,9 @@ token_auth();
                                $params = array('displayname', 'dialplan', 'linetext', 'registrar', 'r_port', 'proxy', 'p_port');
                                foreach ( $params as $p )
                                {
-                                       if ( array_key_exists($p, $_GET ) )
+                                       if ( array_key_exists($p, $_POST ) )
                                        {
-                                               $data = $_GET[$p];
+                                               $data = $_POST[$p];
                                                $t = update_provision_data($p, $username, $domain, $data);
                                                if ( $t != true )
                                                {
@@ -617,20 +617,20 @@ token_auth();
                                print json_encode( array( 'response' => 'invalid', 'cause' => 'parameters' ) );
                        break;
                case "/available":
-                       if ( ( array_key_exists( 'username', $_GET) && array_key_exists( 'domain', $_GET ) ) 
-                               || array_key_exists('user', $_GET) )
+                       if ( ( array_key_exists( 'username', $_POST) && array_key_exists( 'domain', $_POST ) ) 
+                               || array_key_exists('user', $_POST) )
 
                        {
                                $username = "";
                                $domain = "";
-                               if ( array_key_exists('username', $_GET) )
+                               if ( array_key_exists('username', $_POST) )
                                {
-                                       $username = $_GET['username'];
-                                       $domain = $_GET['domain'];
+                                       $username = $_POST['username'];
+                                       $domain = $_POST['domain'];
                                }
                                else
                                {
-                                       $user = split_sipaddress($_GET['user']);
+                                       $user = split_sipaddress($_POST['user']);
                                        if ( !$user )
                                        {
                                                print json_encode ( array( 'response' => 'failed', 'cause' => 'invalid', 'detail' => 'Invalid SIP address') );