diff --git a/api.backend.php b/api.backend.php index e84963b..19e00c4 100644 --- a/api.backend.php +++ b/api.backend.php @@ -15,18 +15,6 @@ function checkRemoteFile($link){ endif; } -function genApiKey(){ // Randomly generate a new api key or something - $time = mt_rand(17, 33); - $key = substr(number_format(time() * mt_rand(),0,'',''),0,10); - $key = base_convert($key, 10, 36); - for($i=0, $i<$time, $i++){ - $key .= substr(number_format(time() * mt_rand(),0,'',''),0,10); - $key = base_convert($key, 10, 36); - } - $key = hash("sha256", $key); - return $key; -} - include('hashpass.php'); class api{ @@ -38,6 +26,7 @@ class api{ $canshort = $row['short']; $name = $row['name']; + $name = addslashes($name); $ip = $_SERVER['REMOTE_ADDR']; $apisql = "INSERT INTO `apiuse` (time, name, apikey, ip, type, allowed, misc) VALUES (NOW(), '$name', '$apikey', '$ip', 'Link Shorten', '$canshort', '$link')"; @@ -73,6 +62,7 @@ class api{ $canshort = $row['short']; $name = $row['name']; + $name = addslashes($name); $ip = $_SERVER['REMOTE_ADDR']; $apisql = "INSERT INTO `apiuse` (time, name, apikey, ip, type, allowed, misc) VALUES (NOW(), '$name', '$apikey', '$ip', 'Short Link Delete', '$canshort', '$link')"; @@ -103,7 +93,8 @@ class api{ if($row = $result->fetch_assoc()){ $canshort = $row['short']; $name = $row['name']; - + + $name = addslashes($name); $ip = $_SERVER['REMOTE_ADDR']; $apisql = "INSERT INTO `apiuse` (time, name, apikey, ip, type, allowed, misc) VALUES (NOW(), '$name', '$apikey', '$ip', 'Report Link', '$canshort', '$link')"; @@ -125,6 +116,7 @@ class api{ $canimg = $row['image']; $name = $row['name']; + $name = addslashes($name); $ip = $_SERVER['REMOTE_ADDR']; $apisql = "INSERT INTO `apiuse` (time, name, apikey, ip, type, allowed, misc) VALUES (NOW(), '$name', '$apikey', '$ip', 'Image Upload', '$canimg', '$name')"; @@ -193,6 +185,7 @@ class api{ $canImg = $row['image']; $name = $row['name']; + $name = addslashes($name); $ip = $_SERVER['REMOTE_ADDR']; $apisql = "INSERT INTO `apiuse` (time, name, apikey, ip, type, allowed, misc) VALUES (NOW(), '$name', '$apikey', '$ip', 'Image Delete', '$canImg', '$imgName')"; @@ -215,7 +208,8 @@ class api{ if($row = $result->fetch_assoc()){ $canImg = $row['image']; $name = $row['name']; - + + $name = addslashes($name); $ip = $_SERVER['REMOTE_ADDR']; $apisql = "INSERT INTO `apiuse` (time, name, apikey, ip, type, allowed, misc) VALUES (NOW(), '$name', '$apikey', '$ip', 'Image Edit', '$canImg', '$imgName/$private')"; @@ -259,6 +253,7 @@ class api{ $canReg = $row['reg']; $name = $row['name']; + $name = addslashes($name); $ip = $_SERVER['REMOTE_ADDR']; $apisql = "INSERT INTO `apiuse` (time, name, apikey, ip, type, allowed, misc) VALUES (NOW(), '$name', '$apikey', '$ip', 'Register User', '$canReg', '$username')"; @@ -283,6 +278,7 @@ class api{ } return "Registered $username."; } +<<<<<<< HEAD function regAPI($apidb, $apikey, $name, $email, $perms){ $apisql = "SELECT * FROM `users` WHERE `key` = '$apikey' LIMIT 1;"; @@ -322,6 +318,8 @@ class api{ if(!$result = $apidb->query($apisql)) return 'ERROR: ['.$apidb->error.']'; return "Registered $name for API use. Key: $key"; } +======= +>>>>>>> parent of 6d43aa8... Add register new API user\n\nRemove addslashes for name cleaning\n - That's something that should be done at the endpoint } ?> \ No newline at end of file