diff --git a/php/api.php b/php/api.php index 4c259cb..d9e8381 100755 --- a/php/api.php +++ b/php/api.php @@ -5,8 +5,15 @@ # @copyright 2015 by Tobias Reich ### -if (!empty($_POST['function'])||!empty($_GET['function'])) { +# Define the called function +if (isset($_POST['function'])) $fn = $_POST['function']; +else if (isset($_GET['function'])) $fn = $_GET['function']; +else $fn = null; +# Check if a function has been specified +if (!empty($fn)) { + + # Start the session and set the default timezone session_start(); date_default_timezone_set('UTC'); @@ -15,6 +22,13 @@ if (!empty($_POST['function'])||!empty($_GET['function'])) { require(__DIR__ . '/autoload.php'); require(__DIR__ . '/modules/misc.php'); + # Validate parameters + if (isset($_POST['albumIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['albumIDs'])!==1) exit('Error: Wrong parameter type for albumIDs!'); + if (isset($_POST['photoIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['photoIDs'])!==1) exit('Error: Wrong parameter type for photoIDs!'); + if (isset($_POST['albumID'])&&preg_match('/^[0-9sfr]{1,}$/', $_POST['albumID'])!==1) exit('Error: Wrong parameter type for albumID!'); + if (isset($_POST['photoID'])&&preg_match('/^[0-9]{14}$/', $_POST['photoID'])!==1) exit('Error: Wrong parameter type for photoID!'); + + # Check if a configuration exists if (file_exists(LYCHEE_CONFIG_FILE)) require(LYCHEE_CONFIG_FILE); else { @@ -46,16 +60,7 @@ if (!empty($_POST['function'])||!empty($_GET['function'])) { $plugins = explode(';', $settings['plugins']); $plugins = new Plugins($plugins, $database, $settings); - # Validate parameters - if (isset($_POST['albumIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['albumIDs'])!==1) exit('Error: Wrong parameter type for albumIDs!'); - if (isset($_POST['photoIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['photoIDs'])!==1) exit('Error: Wrong parameter type for photoIDs!'); - if (isset($_POST['albumID'])&&preg_match('/^[0-9sfr]{1,}$/', $_POST['albumID'])!==1) exit('Error: Wrong parameter type for albumID!'); - if (isset($_POST['photoID'])&&preg_match('/^[0-9]{14}$/', $_POST['photoID'])!==1) exit('Error: Wrong parameter type for photoID!'); - - # Function for switch statement - if (isset($_POST['function'])) $fn = $_POST['function']; - else $fn = $_GET['function']; - + # Check if user is logged if ((isset($_SESSION['login'])&&$_SESSION['login']===true)&& (isset($_SESSION['identifier'])&&$_SESSION['identifier']===$settings['identifier'])) { @@ -85,8 +90,8 @@ if (!empty($_POST['function'])||!empty($_GET['function'])) { } else { - exit('Error: Called function not found!'); + exit('Error: No API function specified!'); } -?> +?> \ No newline at end of file