Congegni/sintonia
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'cc-5709-airtime-analyzer' into cc-5709-airtime-analyzer-cloud-storage

Browse source
This commit is contained in:
drigato 2014-10-30 12:17:34 -04:00
commit b871b32175
10 changed files with 724 additions and 246 deletions
Download patch file Download diff file Expand all files Collapse all files

25
airtime_mvc/application/modules/rest/controllers/MediaController.php
View file

@ -315,12 +315,18 @@ class Rest_MediaController extends Zend_Rest_Controller
}
return $id;
}
private function verifyAuth($checkApiKey, $checkSession)
{
//Session takes precedence over API key for now:
if ($checkSession && $this->verifySession())
{
// Session takes precedence over API key for now:
if ($checkSession && $this->verifySession()) {
// CSRF token validation only applies to session based authorization.
if(!$this->verifyCSRFToken($this->_getParam('csrf_token'))){
$resp = $this->getResponse();
$resp->setHttpResponseCode(401);
$resp->appendBody("ERROR: Token Missmatch.");
return false;
}
return true;
}
@ -336,6 +342,17 @@ class Rest_MediaController extends Zend_Rest_Controller
return false;
}
private function verifyCSRFToken($token){
$current_namespace = new Zend_Session_Namespace('csrf_namespace');
$observed_csrf_token = $token;
$expected_csrf_token = $current_namespace->authtoken;
if($observed_csrf_token == $expected_csrf_token){
return true;
}else{
return false;
}
}
private function verifyAPIKey()
{