V1 API for sending location reports. Disabled the old pseudo-API.

sql/setup.sql

@@ -333,11 +333,11 @@ CREATE TABLE festival_offer (
 DROP TABLE IF EXISTS location;
 CREATE TABLE location (
 	id		INT			AUTO_INCREMENT 	PRIMARY KEY,
-	action	VARCHAR(40)	NOT NULL,
+	action	VARCHAR(1)	NOT NULL,
 	dtime	TIMESTAMP	NOT NULL		DEFAULT now(),
-	lat		DOUBLE		NOT NULL,
-	lon		DOUBLE		NOT NULL,
-	manual	BOOLEAN		NOT NULL		DEFAULT 0,
+	lat		DOUBLE,
+	lon		DOUBLE,
+	start	INT,
 	user	INT			NOT NULL		REFERENCES user.id
 );
 

www/API/v1/location.php

@@ -63,7 +63,7 @@
 	}
 	
 	//Get location
-	$q = mysqli_query($con, "SELECT lat, lon, dtime FROM location WHERE action = 'report' AND dtime > NOW() - INTERVAL 30 MINUTE ORDER BY dtime DESC LIMIT 1;");
+	$q = mysqli_query($con, "SELECT lat, lon, dtime FROM location WHERE action <> 'F' AND lat IS NOT null AND lon IS NOT null AND dtime > NOW() - INTERVAL 30 MINUTE ORDER BY dtime DESC LIMIT 1;");
 	if (mysqli_num_rows($q) > 0){
 		$r = mysqli_fetch_array($q);
 		switch ($format){

www/API/v1/sendlocation.php

@@ -0,0 +1,147 @@
+<?php
+
+	// $_GET valid parameters
+	define('GET_USER', 'user');
+	define('GET_PASS', 'pass');
+	define('GET_ACTION', 'action');
+	define('GET_LAT', 'lat');
+	define('GET_LON', 'lon');
+
+	// Valid values
+	define('ACTION_START', 'start');
+	define('ACTION_REFRESH', 'refresh');
+	define('ACTION_STOP', 'stop');
+	$actions = [ACTION_START, ACTION_REFRESH, ACTION_STOP];
+
+	// Error messages
+	define('ERR_USER', '-USER:');
+	define('ERR_ACTION', '-ACTION:');
+	define('ERR_LOCATION', '-TITLE:');
+
+	/****************************************************
+	* This function is called from almost everywhere at *
+	* the beggining of the page. It initializes the     *
+	* session variables, connect to the db, enabling    *
+	* the variable $con for futher use everywhere in    *
+	* the php code, and populates the arrays $user      *
+	* and $permission, with info about the user.        *
+	*                                                   *
+	* @return: (db connection): The connection handler. *
+	****************************************************/
+	function startdb(){
+		//Include the db configuration file. It's somehow like this
+		/*
+		 <?php
+		  $host = 'XXXX';
+		  $db_name = 'XXXX';
+		  $username_ro = 'XXXX';
+		  $username_rw = 'XXXX';
+		  $pass_ro = 'XXXX';
+		  $pass_rw = 'XXXX';
+		 ?>
+		*/
+		include('../../.htpasswd');
+
+		//Connect to to database
+		$con = mysqli_connect($host, $username_rw, $pass_rw, $db_name);
+
+		//Set encoding options
+		mysqli_set_charset($con, 'utf-8');
+		header('Content-Type: text/html; charset=utf8');
+		mysqli_query($con, 'SET NAMES utf8;');
+
+		//Return the db connection
+		return $con;
+	}
+
+	$con = startdb('rw');
+
+	//Get fields
+	$user = mysqli_real_escape_string($con, $_GET[GET_USER]);
+	$pass = mysqli_real_escape_string($con, $_GET[GET_PASS]);
+	$lat = mysqli_real_escape_string($con, $_GET[GET_LAT]);
+	$lon = mysqli_real_escape_string($con, $_GET[GET_LON]);
+	$action = mysqli_real_escape_string($con, $_GET[GET_ACTION]);
+
+	//Validate user
+	$q = mysqli_query($con, "SELECT id FROM user WHERE username = '$user' AND md5(concat(password, md5(salt))) = '$pass';");
+	if (mysqli_num_rows($q) == 0){
+		error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
+		http_response_code(403); // Forbidden
+		$error = $error . ERR_TARGET . mysqli_real_escape_string($con, $_GET[GET_TARGET]);
+	}
+	// Get id
+	$r = mysqli_fetch_array($q);
+	$uid = $r['id'];
+
+	//Validate fields
+	if (!in_array($action, $actions)){
+		http_response_code(400); // Bad request
+		$error = $error . ERR_ACTION . $action;
+	}
+	if (is_numeric($lat) == false || is_numeric($lon) == false){
+		http_response_code(400); // Bad request
+		$error = $error . ERR_LOCATION . '($lat, $lon)';
+	}
+	if (strlen($lat) == 0 xor strlen($lon) == 0){
+		// Only one coordinate.
+		http_response_code(400); // Bad request
+		$error = $error . ERR_LOCATION . '($lat, $lon)';
+	}
+	if (strlen($lat) != 0 && ($lat < -90.0 || $lat > 90.0)){
+		// Invalid latitude
+		http_response_code(400); // Bad request
+		$error = $error . ERR_LOCATION . '(Lat: $lat)';
+	}
+	if (strlen($lon) != 0 && ($lon < -180.0 || $lon > 180.0)){
+		// Invalid longitude
+		http_response_code(400); // Bad request
+		$error = $error . ERR_LOCATION . '(Lon: $lat)';
+	}
+
+	// Discern action
+	switch ($action){
+		case ACTION_START:
+			// Insert
+			mysqli_query($con, "INSERT INTO location (lat, lon, action, user) VALUES ($lat, $lon, 'S', $uid);");
+			break;
+		case ACTION_REFRESH:
+			// Look for start node.
+			$q = mysqli_query($con, "SELECT id, start FROM location WHERE user = $uid AND dtime > NOW() - INTERVAL 30 MINUTE ORDER BY dtime DESC LIMIT 1;");
+			if (mysqli_num_rows($q) == 0){
+				// No recent reports. Start anew.
+				mysqli_query($con, "INSERT INTO location (lat, lon, action, user) VALUES ($lat, $lon, 'S', $uid);");
+			}
+			else{
+				$r = mysqli_fetch_array($q);
+				if ($r['action'] == 'F'){
+					// Previous track was stoped. Start anew.
+					mysqli_query($con, "INSERT INTO location (lat, lon, action, user) VALUES ($lat, $lon, 'S', $uid);");
+				}
+				else{
+					// Continue track.
+					$s = $r['start'];
+					mysqli_query($con, "INSERT INTO location (lat, lon, action, user, start) VALUES ($lat, $lon, 'S', $uid, $s);");
+				}
+			}
+			break;
+		case ACTION_STOP:
+			// Look for start node.
+			$q = mysqli_query($con, "SELECT id, start FROM location WHERE user = $uid AND dtime > NOW() - INTERVAL 30 MINUTE ORDER BY dtime DESC LIMIT 1;");
+			if (mysqli_num_rows($q) > 0){
+				$r = mysqli_fetch_array($q);
+				if ($r['action'] != 'F'){
+					// Finish track.
+					$s = $r['start'];
+					if (strlen($lat) > 0 && strlen($lon) > 0){
+						mysqli_query($con, "INSERT INTO location (lat, lon, action, user, start) VALUES ($lat, $lon, 'F', $uid, $s);");
+					}
+					else{
+						mysqli_query($con, "INSERT INTO location (action, user, start) VALUES ('F', $uid, $s);");
+					}
+				}
+			}
+			break;
+	}
+	http_response_code(204); // No content.
+?>

www/API/v1/sync.php

@@ -142,7 +142,7 @@
 				$tables = [ 'post', 'post_comment', 'post_image', 'post_tag' ];
 				break;
 			case SEC_ACTIVITIES:
-				$tables = [ 'activity', 'activity_itinerary', 'activity_comment', 'activity_image', 'activity_tag', 'activity_itinerary', 'location', 'album', 'photo', 'photo_album', 'photo_comment', 'place' ];
+				$tables = [ 'activity', 'activity_itinerary', 'activity_comment', 'activity_image', 'activity_tag', 'activity_itinerary', 'album', 'photo', 'photo_album', 'photo_comment', 'place' ];
 				break;
 			case SEC_GALLERY:
 				$tables = [ 'album', 'photo', 'photo_album', 'photo_comment', 'place' ];

www/app/location.php

@@ -3,7 +3,8 @@
 	$con = startdb();
 		
 	//Get user entry
-	$q = mysqli_query($con, "SELECT lat, lon, dtime, username, manual, action FROM location, user WHERE action = 'report' AND user.id = location.user AND dtime > NOW() - INTERVAL 30 MINUTE ORDER BY dtime DESC LIMIT 1;");
+	// DEBUG 1=0. Disabled.
+	$q = mysqli_query($con, "SELECT lat, lon, dtime, username, manual, action FROM location, user WHERE 0=1 AND action = 'report' AND user.id = location.user AND dtime > NOW() - INTERVAL 30 MINUTE ORDER BY dtime DESC LIMIT 1;");
 	if (mysqli_num_rows($q) > 0){
 		$r = mysqli_fetch_array($q);
 		echo("<reporting>1</reporting>\n");