lychee/php/api.php

100 lines
2.6 KiB
PHP
Raw Normal View History

<?php
2014-04-12 12:10:08 +00:00
###
2014-04-27 13:24:51 +00:00
# @name API
2014-04-12 12:10:08 +00:00
# @author Tobias Reich
# @copyright 2014 by Tobias Reich
###
@ini_set('max_execution_time', '200');
@ini_set('post_max_size', '200M');
@ini_set('upload_max_size', '200M');
@ini_set('upload_max_filesize', '20M');
@ini_set('max_file_uploads', '100');
if (!empty($_POST['function'])||!empty($_GET['function'])) {
session_start();
2014-02-09 18:21:55 +00:00
date_default_timezone_set('UTC');
2014-04-13 12:08:18 +00:00
# Define globals
require(__DIR__ . '/define.php');
2014-04-12 12:10:08 +00:00
# Load autoload
2014-04-09 18:07:25 +00:00
require(__DIR__ . '/autoload.php');
2014-04-02 17:30:58 +00:00
2014-04-12 12:10:08 +00:00
# Load modules
2014-04-09 18:07:25 +00:00
require(__DIR__ . '/modules/misc.php');
2014-02-17 16:01:46 +00:00
2014-04-13 12:08:18 +00:00
if (file_exists(LYCHEE_CONFIG_FILE)) require(LYCHEE_CONFIG_FILE);
else {
2014-04-27 13:24:51 +00:00
###
# Installation Access
# Limited access to configure Lychee. Only available when the config.php file is missing.
###
2014-02-09 18:21:55 +00:00
define('LYCHEE_ACCESS_INSTALLATION', true);
2014-04-09 18:07:25 +00:00
require(__DIR__ . '/access/installation.php');
exit();
}
2014-04-12 12:10:08 +00:00
# Connect to database
2014-04-04 19:59:39 +00:00
$database = Database::connect($dbHost, $dbUser, $dbPassword, $dbName);
2014-04-04 21:17:54 +00:00
2014-04-12 12:10:08 +00:00
# Load settings
2014-04-04 21:17:54 +00:00
$settings = new Settings($database);
$settings = $settings->get();
2014-02-07 23:08:18 +00:00
2014-04-12 12:10:08 +00:00
# Init plugins
2014-04-02 17:30:58 +00:00
$plugins = explode(';', $settings['plugins']);
2014-04-19 14:55:17 +00:00
$plugins = new Plugins($plugins, $database, $settings);
2014-04-02 17:30:58 +00:00
2014-04-12 12:10:08 +00:00
# Escape
2014-02-09 18:21:55 +00:00
foreach(array_keys($_POST) as $key) $_POST[$key] = mysqli_real_escape_string($database, urldecode($_POST[$key]));
foreach(array_keys($_GET) as $key) $_GET[$key] = mysqli_real_escape_string($database, urldecode($_GET[$key]));
2014-04-12 12:10:08 +00:00
# Validate parameters
2014-02-09 18:21:55 +00:00
if (isset($_POST['albumIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['albumIDs'])!==1) exit('Error: Wrong parameter type for albumIDs!');
if (isset($_POST['photoIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['photoIDs'])!==1) exit('Error: Wrong parameter type for photoIDs!');
if (isset($_POST['albumID'])&&preg_match('/^[0-9sf]{1,}$/', $_POST['albumID'])!==1) exit('Error: Wrong parameter type for albumID!');
if (isset($_POST['photoID'])&&preg_match('/^[0-9]{14}$/', $_POST['photoID'])!==1) exit('Error: Wrong parameter type for photoID!');
2014-02-17 16:01:46 +00:00
2014-04-12 12:10:08 +00:00
# Fallback for switch statement
2014-04-30 08:56:04 +00:00
if (isset($_POST['function'])) $fn = $_POST['function'];
else $fn = $_GET['function'];
2014-02-23 21:42:15 +00:00
if (isset($_SESSION['login'])&&$_SESSION['login']==true) {
2014-04-27 13:24:51 +00:00
###
# Admin Access
# Full access to Lychee. Only with correct password/session.
###
2014-02-17 16:01:46 +00:00
2014-02-09 18:21:55 +00:00
define('LYCHEE_ACCESS_ADMIN', true);
2014-04-28 09:24:00 +00:00
$admin = new Admin($database, $plugins, $settings);
2014-04-30 08:56:04 +00:00
$admin->check($fn);
} else {
2014-04-27 13:24:51 +00:00
###
# Guest Access
# Access to view all public folders and photos in Lychee.
###
2014-02-09 18:21:55 +00:00
define('LYCHEE_ACCESS_GUEST', true);
2014-04-30 08:56:04 +00:00
$guest = new Guest($database, $plugins, $settings);
$guest->check($fn);
}
} else {
exit('Error: Called function not found!');
}
2012-10-02 15:48:08 +00:00
?>