#4558 - Build-in API support (!AUTH CHANGES!)

api.php

@@ -3,6 +3,23 @@
 define('BX_API', true);
 
 require_once('./inc/header.inc.php');
+
+if (bx_get('ses_sync') ){
+    $aData = (new BxDolSessionQuery())->getCookie(bx_get('ses_sync'));
+    if ($aData){
+        $aCookies = json_decode($aData, true);
+        foreach ($aCookies as $i => $aCookie){
+            //unset($_COOKIE[$aCookie[0]]); 
+            //setcookie($aCookie[0], '', -1, '/'); 
+         //   $aCookie[2]['domain']='';
+            setcookie($aCookie[0], $aCookie[1], $aCookie[2]);
+        }
+    }
+
+    echo json_encode([$aData]);
+    exit();
+}
+
 require_once(BX_DIRECTORY_PATH_INC . "profiles.inc.php");
 require_once(BX_DIRECTORY_PATH_INC . "design.inc.php");
 
@@ -86,10 +103,17 @@ if (is_array($mixedRet) && isset($mixedRet['error'])) {
     exit;
 }
 
-echo json_encode([
+$aRv = [
     'status' => 200,
     'module' => $sModule,
     'method' => $sMethod,
     'params' => $aParams,
     'data' => $mixedRet,
-]);
+];
+
+if (isset($GLOBALS['session_key'])){
+    $sKey = (new BxDolSessionQuery())->addCookie(json_encode($GLOBALS['session_key']));
+    $aRv['session_key'] = $sKey;
+}
+
+echo json_encode($aRv);

inc/classes/BxDolSessionQuery.php

@@ -19,11 +19,29 @@ class BxDolSessionQuery extends BxDolDb
         parent::__construct();
 
         $this->sTable = 'sys_sessions';
+        $this->sTableCookies = 'sys_cookies';
     }
     function getTableName()
     {
         return $this->sTable;
     }
+    
+    function addCookie($sCookies){
+        $sKey = strtolower(genRndPwd(32, false));
+        
+        if (rand(1, 20) == 10){
+            $sSql = $this->prepare("DELETE FROM `" . $this->sTableCookies . "` WHERE `added` < ? ", time() - 36000);
+            $this->query($sSql);
+        }
+        
+        $this->query("INSERT INTO `" . $this->sTableCookies . "` (`key`, `cookies`, `added`) VALUES (:key, :cookies, :added)", ['key' => $sKey, 'cookies' => $sCookies, 'added' => time()]);
+        return $sKey;
+    }
+    
+    function getCookie($sKey){
+        return $this->getOne("SELECT `cookies` FROM `" . $this->sTableCookies . "` WHERE `key` = :key", ['key' => $sKey]);
+    }
+    
     function exists($sId)
     {
         $sSql = $this->prepare("SELECT `id`, `user_id`, `data` FROM `" . $this->sTable . "` WHERE `id`=? LIMIT 1", $sId);

inc/profiles.inc.php

@@ -163,7 +163,8 @@ function bx_logout($bNotify = true)
         unset($_COOKIE['memberPassword']);
     }
 
-    BxDolSession::getInstance()->destroy();
+    // BxDolSession::getInstance()->destroy();
+    BxDolSession::getInstance()->setUserId(0);
 }
 
 /**

inc/utils.inc.php

@@ -2313,6 +2313,9 @@ function bx_birthday2age($sBirthday)
 
 function bx_setcookie($sName, $sValue = "", $oExpiresOrOptions = 0, $sPath = 'auto', $sDomain = '', $bSecure = 'auto', $bHttpOnly = false)
 {
+    if (bx_is_api() && bx_get('ses_sync'))
+        return ;
+       
     $aUrl = 'auto' === $sPath || 'auto' === $bSecure ? parse_url(BX_DOL_URL_ROOT) : [];
 
     if (defined('BX_MULTISITE_URL_COOKIE')) {
@@ -2345,7 +2348,9 @@ function bx_setcookie($sName, $sValue = "", $oExpiresOrOptions = 0, $sPath = 'au
         ];
         if (!defined('BX_MULTISITE_URL_COOKIE') && !isset($aOptions['samesite']) && ('memberPassword' == $sName || 'memberSession' == $sName))
             $aOptions['samesite'] = bx_is_api() ? getParam('sys_api_cookie_samesite') : getParam('sys_samesite_cookies');
-
+        if (bx_is_api()){
+            $GLOBALS['session_key'][$sName] =  [$sName, $sValue, $aOptions];
+        }
         return setcookie($sName, $sValue, $aOptions);
     }
 }
@@ -2375,6 +2380,25 @@ function bx_is_api()
     return defined('BX_API') || bx_get('api') ? true : false;
 }
 
+function bx_api_get_sql($q)
+{
+    $sql = false;
+    $t = false;
+    if ($q == 'accounts_count'){
+        $sql = 'SELECT Count(*) FROM sys_accounts';
+        $t = 'One';
+    }
+    
+    if ($sql){
+        $oDb = BxDolDb::getInstance();
+        if ($t == 'One')
+            echo json_encode($oDb->getOne($sql));
+        else
+            echo json_encode($oDb->getAll($sql));
+        exit;
+    }
+}
+
 function bx_api_check_access()
 {
     if (!getParam('sys_api_enable')) {
@@ -2399,13 +2423,8 @@ function bx_api_check_access()
             echo json_encode(['status' => 403, 'error' => _t("_Access denied")]);
             exit;
         }
-        elseif(bx_get('r') == 'q'){
-            $oDb = BxDolDb::getInstance();
-            if (bx_get('t') == 'One')
-                echo json_encode($oDb->getOne(bx_get('q')));
-            else
-                echo json_encode($oDb->getAll(bx_get('q')));
-            exit;
+        if(bx_get('r') == 'q'){
+            bx_api_get_sql(bx_get('q'));
         }
     }
     elseif (getParam('sys_api_access_by_origin') && $sOriginHeader) {
@@ -2420,6 +2439,10 @@ function bx_api_check_access()
 
             header('Access-Control-Allow-Origin: ' . $sOriginHeader);
             header('Access-Control-Allow-Credentials: true');
+            
+            if(bx_get('r') == 'q'){
+                bx_api_get_sql(bx_get('q'));
+            }
 
             if ('OPTIONS' == $_SERVER['REQUEST_METHOD']) {
                 header('Access-Control-Allow-Methods: POST, GET');

template/scripts/BxBaseServiceLogin.php

@@ -173,9 +173,9 @@ class BxBaseServiceLogin extends BxDol
                 $oAccount = BxDolAccount::getInstance(trim($oForm->getCleanValue('ID')));
                 bx_login($oAccount->id(), ($oForm->getCleanValue('rememberMe') ? true : false));
                 return [
+                    //bx_api_get_block('login', ['session' => BxDolSession::getInstance()->getId()], ['id' => 2]),
                     bx_api_get_block('redirect', ['uri' => '/']),
                     bx_api_get_block('form', $oForm->getCodeAPI(), ['ext' => ['request' => ['url' => '/api.php?r=system/login_form/TemplServiceLogin', 'immutable' => true]]]),
-                    bx_api_get_block('login', ['session' => BxDolSession::getInstance()->getId()], ['id' => 2]),
                 ];
             } 
             else {