X-Git-Url: https://git.defcon.no/?a=blobdiff_plain;f=api%2Flib%2Fauth_base.php;h=0bf65f75eea7900dbc4dc0c5209f9e50545e4c85;hb=87cde98c94c33708506b8e94db43726393df5dfa;hp=bb3c26fa411e8931be33454f140ea6f0313d66d6;hpb=35d61a3bc82ba46a3dc574c3165e9afc05ef7c0f;p=hermes

diff --git a/api/lib/auth_base.php b/api/lib/auth_base.php
index bb3c26f..0bf65f7 100644
--- a/api/lib/auth_base.php
+++ b/api/lib/auth_base.php
@@ -1,4 +1,30 @@
 <?php
+/*
+#  Copyright (c) 2012, Gjøvik University College
+#  All rights reserved.
+
+#  Redistribution and use in source and binary forms, with or without
+#  modification, are permitted provided that the following conditions are met:
+#      * Redistributions of source code must retain the above copyright
+#        notice, this list of conditions and the following disclaimer.
+#      * Redistributions in binary form must reproduce the above copyright
+#        notice, this list of conditions and the following disclaimer in the
+#        documentation and/or other materials provided with the distribution.
+#      * Neither the name of the Gjøvik University College nor the
+#        names of its contributors may be used to endorse or promote products
+#        derived from this software without specific prior written permission.
+#  
+#  THIS SOFTWARE IS PROVIDED BY Gjøvik University College ''AS IS'' AND ANY
+#  EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#  DISCLAIMED. IN NO EVENT SHALL Gjøvik University College BE LIABLE FOR ANY
+#  DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
 require_once('config.php');
 
 $config = get_config();
@@ -73,17 +99,17 @@ function simple_authfail()
 
 function token_auth( )
 {
-	global $_GET;
+	global $_POST;
 
 	// TODO: Part of ping/pong requirement.
 	// Run a function to clear all authkeys older than 5 minutes.
 	expire_authkeys();
 
-	if ( array_key_exists('session', $_GET ) 
-	     && array_key_exists('auth_key', $_GET ) )
+	if ( array_key_exists('session', $_POST ) 
+	     && array_key_exists('auth_key', $_POST ) )
 	{ 
-		if ( ! check_session($_GET['session'] ) ) simple_authfail();
-		if ( ! check_authkey($_GET['auth_key'] ) ) simple_authfail(); 
+		if ( ! check_session($_POST['session'] ) ) simple_authfail();
+		if ( ! check_authkey($_POST['auth_key'] ) ) simple_authfail(); 
 	}
 	else simple_authfail();
 }
@@ -112,7 +138,7 @@ function expire_authkeys()
 	$query = sprintf("SELECT session, sessid FROM %s WHERE `last` < DATE_SUB( NOW(), INTERVAL %d MINUTE)",
 		$config['sessionkeys_table'],
 		$config['sessionkey_lifetime']);
-	$result = sql_dbquery( $config['provision_db'], $query );
+	$result = sql_dbquery( $config['hermes_db'], $query );
 	while ( $row = @mysql_fetch_row( $result ) )
 	{
 		remove_session( $row[0], $row[1] );
@@ -122,7 +148,7 @@ function expire_authkeys()
 		$config['sessionkeys_table'],
 		$config['sessionkey_lifetime']);
 
-	sql_dbexec( $config['provision_db'], $query );
+	sql_dbexec( $config['hermes_db'], $query );
 }
 
 function update_authkey ( $session, $authid )
@@ -146,7 +172,7 @@ function update_authkey ( $session, $authid )
 		sql_clean($remote),
 		sql_clean($key),
 		sql_clean($key));
-	if ( ! sql_dbexec( $config['provision_db'], $query ) )
+	if ( ! sql_dbexec( $config['hermes_db'], $query ) )
 	{
 		mysql_error();
 	}
@@ -214,7 +240,7 @@ function clear_credentials($name)
 	$query = sprintf("DELETE FROM %s WHERE `session` = '%s'",
 		$config['sessionkeys_table'],
 		sql_clean($name));
-	sql_dbexec( $config['provision_db'], $query );
+	sql_dbexec( $config['hermes_db'], $query );
 
 	return false;
 }
@@ -259,7 +285,7 @@ function add_apikey ( $host, $level )
 		sql_clean($host),
 		sql_clean($key));
 
-	if ( ! sql_dbexec( $config['provision_db'], $query ) ) return false;
+	if ( ! sql_dbexec( $config['hermes_db'], $query ) ) return false;
 	return $key;
 }
 
@@ -272,7 +298,7 @@ function remove_apikey( $key )
 	$query = sprintf("DELETE FROM %s WHERE apikey = '%s'",
 		$config['apikeys_table'],
 		sql_clean($key) );
-	if ( ! sql_dbexec( $config['provision_db'], $query ) ) return false;
+	if ( ! sql_dbexec( $config['hermes_db'], $query ) ) return false;
 
 	return true;
 }
@@ -284,7 +310,7 @@ function verify_apikey( $key, $skip_hostcheck = false )
 	$query = sprintf("SELECT host FROM %s WHERE apikey = '%s'",
 		$config['apikeys_table'],
 		sql_clean($key) );
-	$row = sql_dbquery_single( $config['provision_db'], $query );
+	$row = sql_dbquery_single( $config['hermes_db'], $query );
 	if  (!$row) return false;
 	$host = $row['host'];
 
@@ -306,7 +332,7 @@ function list_apikeys ()
 			$config['apikeys_table'], 
 			$config['authorizations_table']);
 	$list = array();
-	$result = sql_dbquery( $config['provision_db'], $query);
+	$result = sql_dbquery( $config['hermes_db'], $query);
 	if ( ! $result ) return $list; 
 	while ( $row = @mysql_fetch_assoc( $result ) )
 	{
@@ -328,7 +354,7 @@ function list_authusers ()
 				WHERE type = 'user'",
 			$config['authorizations_table']);
 	$list = array();
-	$result = sql_dbquery( $config['provision_db'], $query);
+	$result = sql_dbquery( $config['hermes_db'], $query);
 	if ( ! $result ) return $list; 
 	while ( $row = @mysql_fetch_assoc( $result ) )
 	{
@@ -363,7 +389,7 @@ function update_authorization( $type, $authid, $level )
 		sql_clean($authid),
 		$type,
 		$level, $level);
-	if ( ! sql_dbexec( $config['provision_db'], $query ) ) return false;
+	if ( ! sql_dbexec( $config['hermes_db'], $query ) ) return false;
 	return true;
 }
 
@@ -374,7 +400,7 @@ function remove_authorization( $authid )
 		$config['authorizations_table'],
 		sql_clean($authid) );
 	//print $query . "\n\n";
-	if ( ! sql_dbexec( $config['provision_db'], $query ) ) return false;
+	if ( ! sql_dbexec( $config['hermes_db'], $query ) ) return false;
 	return true;
 }
 
@@ -398,7 +424,7 @@ function get_authorization( $type, $authid )
 	$query = sprintf("SELECT access_level FROM %s  WHERE authid = '%s'",
 		$config['authorizations_table'],
 		sql_clean($authid) );
-	$row = sql_dbquery_single( $config['provision_db'], $query );
+	$row = sql_dbquery_single( $config['hermes_db'], $query );
 	if  (!$row) return false;
 	$level = $row['access_level'];
 	return $level;