maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

remove unnecessary parameter-checks as they will never happen; make Customers.update callable for customers

Browse Source 
Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann (d00p)
2018-02-25 15:02:58 +01:00
parent 243b68cc37
commit a222114d0a
6 changed files with 488 additions and 552 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
lib/classes/api/commands/class.Admins.php
View File

@@ -63,12 +63,8 @@ class Admins extends ApiCommand implements ResourceEntity
{
$id = $this->getParam('id', true, 0);
$ln_optional = ($id <= 0 ? false : true);
$loginname = $this->getParam('loginname', $ln_optional, '');
if ($id <= 0 && empty($loginname)) {
throw new Exception("Either 'id' or 'loginname' parameter must be given", 406);
}
$loginname = trim($this->getParam('loginname', $ln_optional, ''));
if ($this->isAdmin() && ($this->getUserDetail('change_serversettings') == 1 || ($this->getUserDetail('adminid') == $id || $this->getUserDetail('loginname') == $loginname))) {
$result_stmt = Database::prepare("
SELECT * FROM `" . TABLE_PANEL_ADMINS . "`
@@ -318,11 +314,7 @@ class Admins extends ApiCommand implements ResourceEntity
$id = $this->getParam('id', true, 0);
$ln_optional = ($id <= 0 ? false : true);
$loginname = $this->getParam('loginname', $ln_optional, '');
if ($id <= 0 && empty($loginname)) {
throw new Exception("Either 'id' or 'loginname' parameter must be given", 406);
}
$loginname = trim($this->getParam('loginname', $ln_optional, ''));
$json_result = Admins::getLocal($this->getUserData(), array(
'id' => $id,
@@ -583,11 +575,7 @@ class Admins extends ApiCommand implements ResourceEntity
if ($this->isAdmin() && $this->getUserDetail('change_serversettings') == 1) {
$id = $this->getParam('id', true, 0);
$ln_optional = ($id <= 0 ? false : true);
$loginname = $this->getParam('loginname', $ln_optional, '');
if ($id <= 0 && empty($loginname)) {
throw new Exception("Either 'id' or 'loginname' parameter must be given", 406);
}
$loginname = trim($this->getParam('loginname', $ln_optional, ''));
$json_result = Admins::getLocal($this->getUserData(), array(
'id' => $id,
@@ -652,12 +640,8 @@ class Admins extends ApiCommand implements ResourceEntity
if ($this->isAdmin() && $this->getUserDetail('change_serversettings') == 1) {
$id = $this->getParam('id', true, 0);
$ln_optional = ($id <= 0 ? false : true);
$loginname = $this->getParam('loginname', $ln_optional, '');
if ($id <= 0 && empty($loginname)) {
throw new Exception("Either 'id' or 'loginname' parameter must be given", 406);
}
$loginname = trim($this->getParam('loginname', $ln_optional, ''));
$json_result = Admins::getLocal($this->getUserData(), array(
'id' => $id,
'loginname' => $loginname

954
lib/classes/api/commands/class.Customers.php
View File

File diff suppressed because it is too large Load Diff

24
lib/classes/api/commands/class.Domains.php
View File

@@ -73,14 +73,9 @@ class Domains extends ApiCommand implements ResourceEntity
if ($this->isAdmin()) {
$id = $this->getParam('id', true, 0);
$dn_optional = ($id <= 0 ? false : true);
$domainname = $this->getParam('domainname', $dn_optional, '');
$domainname = trim($this->getParam('domainname', $dn_optional, ''));
$no_std_subdomain = $this->getParam('no_std_subdomain', true, false);
$this->logger()->logAction(ADM_ACTION, LOG_NOTICE, "[API] get domain #" . $id);
if ($id <= 0 && empty($domainname)) {
throw new Exception("Either 'id' or 'domainname' parameter must be given", 406);
}
// convert possible idn domain to punycode
if (substr($domainname, 0, 4) != 'xn--') {
$idna_convert = new idna_convert_wrapper();
@@ -101,6 +96,7 @@ class Domains extends ApiCommand implements ResourceEntity
}
$result = Database::pexecute_first($result_stmt, $params, true, true);
if ($result) {
$this->logger()->logAction(ADM_ACTION, LOG_NOTICE, "[API] get domain '" . $result['domain'] . "'");
return $this->response(200, "successfull", $result);
}
$key = ($id > 0 ? "id #" . $id : "domainname '" . $domainname . "'");
@@ -778,11 +774,7 @@ class Domains extends ApiCommand implements ResourceEntity
// parameters
$id = $this->getParam('id', true, 0);
$dn_optional = ($id <= 0 ? false : true);
$domainname = $this->getParam('domainname', $dn_optional, '');
if ($id <= 0 && empty($domainname)) {
throw new Exception("Either 'id' or 'domainname' parameter must be given", 406);
}
$domainname = trim($this->getParam('domainname', $dn_optional, ''));
// get requested domain
$json_result = Domains::getLocal($this->getUserData(), array(
@@ -1595,14 +1587,10 @@ class Domains extends ApiCommand implements ResourceEntity
if ($this->isAdmin()) {
$id = $this->getParam('id', true, 0);
$dn_optional = ($id <= 0 ? false : true);
$domainname = $this->getParam('domainname', $dn_optional, '');
$domainname = trim($this->getParam('domainname', $dn_optional, ''));
$is_stdsubdomain = $this->getParam('is_stdsubdomain', true, 0);
$remove_subbutmain_domains = $this->getParam('delete_mainsubdomains', true, 0);
if ($id <= 0 && empty($domainname)) {
throw new Exception("Either 'id' or 'domainname' parameter must be given", 406);
}
$json_result = Domains::getLocal($this->getUserData(), array(
'id' => $id,
'domainname' => $domainname

8
lib/classes/api/commands/class.Ftps.php
View File

@@ -37,12 +37,8 @@ class Ftps extends ApiCommand implements ResourceEntity
{
$id = $this->getParam('id', true, 0);
$un_optional = ($id <= 0 ? false : true);
$username = $this->getParam('username', $un_optional, '');
if ($id <= 0 && empty($username)) {
throw new Exception("Either 'id' or 'username' parameter must be given", 406);
}
$username = trim($this->getParam('username', $un_optional, ''));
$params = array();
if ($this->isAdmin()) {
if ($this->getUserDetail('customers_see_all') == false) {

24
lib/classes/api/commands/class.Mysqls.php
View File

@@ -238,13 +238,9 @@ class Mysqls extends ApiCommand implements ResourceEntity
{
$id = $this->getParam('id', true, 0);
$dn_optional = ($id <= 0 ? false : true);
$dbname = $this->getParam('dbname', $dn_optional, '');
$dbname = trim($this->getParam('dbname', $dn_optional, ''));
$dbserver = $this->getParam('mysql_server', true, - 1);
if ($id <= 0 && empty($dbname)) {
throw new Exception("Either 'id' or 'dbname' parameter must be given", 406);
}
if ($this->isAdmin()) {
if ($this->getUserDetail('customers_see_all') != 1) {
// if it's a reseller or an admin who cannot see all customers, we need to check
@@ -341,13 +337,9 @@ class Mysqls extends ApiCommand implements ResourceEntity
{
$id = $this->getParam('id', true, 0);
$dn_optional = ($id <= 0 ? false : true);
$dbname = $this->getParam('dbname', $dn_optional, '');
$dbname = trim($this->getParam('dbname', $dn_optional, ''));
$dbserver = $this->getParam('mysql_server', true, - 1);
if ($id <= 0 && empty($dbname)) {
throw new Exception("Either 'id' or 'dbname' parameter must be given", 406);
}
if ($this->isAdmin() == false && Settings::IsInList('panel.customer_hide_options', 'mysql')) {
throw new Exception("You cannot access this resource", 405);
}
@@ -549,13 +541,9 @@ class Mysqls extends ApiCommand implements ResourceEntity
{
$id = $this->getParam('id', true, 0);
$dn_optional = ($id <= 0 ? false : true);
$dbname = $this->getParam('dbname', $dn_optional, '');
$dbname = trim($this->getParam('dbname', $dn_optional, ''));
$dbserver = $this->getParam('mysql_server', true, - 1);
if ($id <= 0 && empty($dbname)) {
throw new Exception("Either 'id' or 'dbname' parameter must be given", 406);
}
if ($this->isAdmin() == false && Settings::IsInList('panel.customer_hide_options', 'mysql')) {
throw new Exception("You cannot access this resource", 405);
}

2
lib/functions/output/function.standard_error.php
View File

@@ -61,7 +61,7 @@ function standard_error($errors = '', $replacer = '', $throw_exception = false)
}
if ($throw_exception) {
throw new Exception($error, 400);
throw new Exception(strip_tags($error), 400);
}
eval("echo \"" . getTemplate('misc/error', '1') . "\";");
exit;