exit ("<html><head></head><body>$body</body></html>");
}
-function success_auth () {
- success ("auth");
+function success_auth ($user) {
+ $res = "<success request=\"$reason\"><user>" .
+ htmlspecialchars ($user) .
+ "</user></success>";
+ exit_document ($res);
}
function success_feature ($feature, $request) {
return null;
}
-function check_auth ($con, $pwd, $cookie_name, $auth_only) {
+function check_auth ($con, $user, $pwd, $auth_only) {
$authentificated = false;
- $user = "admin";
- if ($pwd) {
+ if (isset ($pwd)) {
if ($con->checkpwdmd5 ($user, md5 ($pwd))) {
// cookie will be valid for 2 weeks. I've chosen that value
// arbitrarily, and it may change in the future.
$time = time () + 14 * 60 * 24 * 60;
- setcookie ($cookie_name, md5 ($pwd), $time, "" , "", false, true);
+ setcookie (sprintf ("%sauth", DBPREFIX), md5 ($pwd), $time, "" , "", false, true);
+ setcookie (sprintf ("%suser", DBPREFIX), $user, $time, "" , "", false, true);
$authentificated = true;
if ($auth_only) {
- success_auth ();
+ success_auth ($user);
}
} else {
unauthorized_error ();
}
}
- if (!$authentificated && !($con->checkpwdmd5 ($user,
- $_COOKIE [$cookie_name]))) {
+ if (!$authentificated && !($con->checkpwdmd5 (
+ $_COOKIE [sprintf ("%suser", DBPREFIX)],
+ $_COOKIE [sprintf ("%sauth", DBPREFIX)]))) {
unauthorized_error ();
}
}
request_error ();
}
- $pwd = unquote ($_POST["password"]);
- $cookie_name = sprintf ("%sauth", DBPREFIX);
+ $pwd = unquote ($_POST ["password"]);
+ $user = unquote ($_POST ["user"]);
// does user only want authentication or does he want to do other things
$auth_only = ($_POST ["request"] == "auth");
- check_auth ($con, $pwd, $cookie_name, $auth_only);
+ check_auth ($con, $user, $pwd, $auth_only);
+ if (!$user) {
+ $user = $_COOKIE [sprintf ("%suser", DBPREFIX)];
+ }
switch ($_POST ["request"]) {
case "update":
if (!isset ($feature)) {
unreferenced_error ($id);
}
+ if ($feature->user != $user) {
+ unauthorized_error ();
+ }
// no file uploaded, but editor currently has an image: it means
// image was not changed
$description = unquote ($_POST ["description"]);
try {
- $new_feature = new feature ($id, $lon, $lat, $imgpath, $title, $description, 0);
+ $new_feature = new feature ($id, $lon, $lat, $imgpath, $title, $description, 0, $user);
} catch (Exception $e) {
request_error ();
}
$title = unquote ($_POST ["title"]);
$description = unquote ($_POST ["description"]);
try {
- $feature = new feature (null, $lon, $lat, $imgpath, $title, $description, 0);
+ $feature = new feature (null, $lon, $lat, $imgpath, $title, $description, 0, $user);
} catch (Exception $e) {
request_error ();
}
if (!isset ($feature)) {
unreferenced_error ($id);
}
+ if ($feature->user != $user) {
+ unauthorized_error ();
+ }
$imgpath = $feature->imgpath;
try {