Merge branch 'nightly' into 'nightly'

[quix0rs-gnu-social.git] / lib / apiauthaction.php

diff --git a/lib/apiauthaction.php b/lib/apiauthaction.php
index 2f2e50a4d747b852f1fcbfb18eed1e384cd9b69b..a3deccd3da0e05aa25808b6ab9296a4790d76a8d 100644 (file)
--- a/lib/apiauthaction.php
+++ b/lib/apiauthaction.php
@@ -85,8 +85,10 @@ class ApiAuthAction extends ApiAction
         // NOTE: $this->scoped and $this->auth_user has to get set in
         // prepare(), not handle(), as subclasses use them in prepares.
 
-        // Allow regular login session
-        if (common_logged_in()) {
+        // Allow regular login session, but we have to double-check the
+        // HTTP_REFERER value to avoid cross domain POSTing since the API
+        // doesn't use the "token" form field.
+        if (common_logged_in() && common_local_referer()) {
             $this->scoped = Profile::current();
             $this->auth_user = $this->scoped->getUser();
             if (!$this->auth_user->hasRight(Right::API)) {
@@ -295,7 +297,7 @@ class ApiAuthAction extends ApiAction
             // TRANS: Client error thrown when authentication fails because a user clicked "Cancel".
             $this->clientError(_('Could not authenticate you.'), 401);
 
-        } elseif ($required) {
+        } else {
             // $this->auth_user_nickname - i.e. PHP_AUTH_USER - will have a value since it was not empty
 
             $user = common_check_user($this->auth_user_nickname,
@@ -314,10 +316,10 @@ class ApiAuthAction extends ApiAction
                 $this->auth_user = null;
             }
 
-            // By default, basic auth users have rw access
-            $this->access = self::READ_WRITE;
-
-            if (!$this->auth_user instanceof User) {
+            if ($required && $this->auth_user instanceof User) {
+                // By default, basic auth users have rw access
+                $this->access = self::READ_WRITE;
+            } elseif ($required) {
                 $msg = sprintf(
                     "basic auth nickname = %s",
                     $this->auth_user_nickname
@@ -328,10 +330,10 @@ class ApiAuthAction extends ApiAction
                 header('WWW-Authenticate: Basic realm="' . $realm . '"');
                 // TRANS: Client error thrown when authentication fails.
                 $this->clientError(_('Could not authenticate you.'), 401);
+            } else {
+                // all get rw access for actions that don't require auth
+                $this->access = self::READ_WRITE;
             }
-        } else {
-            // all get rw access for actions that don't require auth
-            $this->access = self::READ_WRITE;
         }
     }