Internal API working.

www-admin/API/v3/auth.php

@@ -0,0 +1,33 @@
+ <?php
+    // Gasteizko Margolariak API v3 //
+
+    // $_POST valid parameters
+    define('POST_USER', 'user');
+    define('POST_PASS', 'pass');
+
+    // Error messages
+    define('ERR_USER', '-USER:');
+
+    include('functions.php');
+    $con = startdb();
+
+    // Error control
+    $error = "";
+
+    // Get params
+    $user = mysqli_real_escape_string($con, $_POST[POST_USER]);
+    $pass = mysqli_real_escape_string($con, $_POST[POST_PASS]);
+
+    //Validate user
+    $uid = login($con, $user, $pass);
+    if ($uid == -1){
+        error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
+        $error = $error . ERR_USER . mysqli_real_escape_string($con, $_POST[GET_USER]);
+        error_log($error);
+        http_response_code(403); // Forbidden
+        exit(-1);
+    }
+    else{
+        http_response_code(204); // No content
+    }
+?>

www-admin/API/v3/functions.php

@@ -145,8 +145,8 @@
      *    con: (Mysql connectrion): DB connection.       *
      *    user: (string): Username.                      *
      *    pass: (string): Password.                      *
-     * @return: (boolean): True if user pass match,      *
-     *           false otherwise.                        *
+     * @return: (int): User id, or -1 if the user and    *
+	 *          pass didn't match.                       *
      *****************************************************/
     function login($con, $user, $pass){
         session_start();
@@ -156,27 +156,14 @@
             $_SESSION['id'] = $r['id'];
             $_SESSION['salt'] = $r['s'];
             $_SESSION['name'] = $r['username'];
-            return true;
+            return $r['id'];
         }
         else{
             error_log("Invalid login. username = $user, id = $_SESSION[id]");
-            return false;
+            return -1;
         }
     }
 
-    /*****************************************************
-     * Tries to login, using parameters sent via POST.   *
-     *                                                   *
-     * @params:                                          *
-     *    con: (Mysql connectrion): DB connection.       *
-     * @return: (boolean): True if user pass match,      *
-     *           false otherwise.                        *
-     *****************************************************/
-    function fastLogin($con){
-        return login($con, mysqli_real_escape_string($con, $_POST["user"]), mysqli_real_escape_string($con, $_POST["pass"]));
-    }
-
-
     /*****************************************************
      * Finds out the IP address of the client.           *
      *                                                   *

www-admin/API/v3/sendlocation.php

@@ -1,12 +1,9 @@
 <?php
     // Gasteizko Margolariak API v3 //
-    
-    //var_dump($_POST);
-    //exit(0);
 
     // $_GET valid parameters
-    define('GET_USER', 'user');
-    define('GET_PASS', 'pass');
+    define('POST_USER', 'user');
+    define('POST_PASS', 'pass');
     define('GET_ACTION', 'action');
     define('GET_LAT', 'lat');
     define('GET_LON', 'lon');
@@ -29,15 +26,16 @@
 
     //Get fields
     
-    $user = mysqli_real_escape_string($con, $_POST[GET_USER]);
-    $pass = mysqli_real_escape_string($con, $_POST[GET_PASS]);
+    $user = mysqli_real_escape_string($con, $_POST[POST_USER]);
+    $pass = mysqli_real_escape_string($con, $_POST[POST_PASS]);
     
     $lat = mysqli_real_escape_string($con, $_GET[GET_LAT]);
     $lon = mysqli_real_escape_string($con, $_GET[GET_LON]);
     $action = mysqli_real_escape_string($con, $_GET[GET_ACTION]);
-
+    
     //Validate user
-    if (!login($con, $user, $pass)){
+	$uid = login($con, $user, $pass);
+    if ($uid == -1){
         error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
         $error = $error . ERR_USER . mysqli_real_escape_string($con, $user);
         error_log($error);

www-admin/API/v3/sendnotification.php

@@ -1,9 +1,9 @@
 <?php
     // Gasteizko Margolariak API v3 //
 
-    // $_GET valid parameters
-    define('GET_USER', 'user');
-    define('GET_PASS', 'pass');
+    // $_GET and $_POST valid parameters
+    define('POST_USER', 'user');
+    define('POST_PASS', 'pass');
     define('GET_TITLE_ES', 'title_es');
     define('GET_TITLE_EN', 'title_en');
     define('GET_TITLE_EU', 'title_eu');
@@ -17,16 +17,16 @@
     define('GET_GM', 'gm');
 
     // Valid values
-    define('ACTION_TEXT', 'mensaje');
+    define('ACTION_TEXT', 'text');
     define('ACTION_BLOG', 'blog');
-    define('ACTION_ACTIVITIES', 'actividades');
-    define('ACTION_GALLERY', 'galeria');
-    define('ACTION_LOCALIZATION', 'localizacion');
+    define('ACTION_ACTIVITIES', 'activities');
+    define('ACTION_GALLERY', 'gallery');
+    define('ACTION_LOCATION', 'location');
     define('ACTION_LABLANCA', 'lablanca');
-    define('ACTION_SCHEDULE', 'programa');
-    define('ACTION_GM_SCHEDULE', 'gprograma');
-    define('ACTION_US', 'nosotros');
-    $actions = [ACTION_TEXT, ACTION_BLOG, ACTION_ACTIVITIES, ACTION_GALLERY, ACTION_LOCALIZATION, ACTION_LABLANCA, ACTION_SCHEDULE, ACTION_GM_SCHEDULE, ACTION_US];
+    define('ACTION_SCHEDULE_CITY', 'schedule_city');
+    define('ACTION_SCHEDULE_GM', 'schedule_gm');
+    define('ACTION_US', 'us');
+    $actions = [ACTION_TEXT, ACTION_BLOG, ACTION_ACTIVITIES, ACTION_GALLERY, ACTION_LOCATION, ACTION_LABLANCA, ACTION_SCHEDULE_CITY, ACTION_SCHEDULE_GM, ACTION_US];
 
     // Default values
     define('DEF_GM', 0);
@@ -44,10 +44,11 @@
 
     include('functions.php');
 
-    $con = startdb();
+    $con = startdb('rw');
 
     // Get fields
-    $user = mysqli_real_escape_string($con, $_GET[GET_USER]);
+    $user = mysqli_real_escape_string($con, $_POST[POST_USER]);
+	$pass = mysqli_real_escape_string($con, $_POST[POST_PASS]);
     $title_es = urldecode(mysqli_real_escape_string($con, $_GET[GET_TITLE_ES]));
     $title_en = urldecode(mysqli_real_escape_string($con, $_GET[GET_TITLE_EN]));
     $title_eu = urldecode(mysqli_real_escape_string($con, $_GET[GET_TITLE_EU]));
@@ -64,9 +65,10 @@
     $error = "";
 
     // Validate user/pass
-    if (!fastLogin($con)){
+    $uid = login($con, $user, $pass);
+    if ($uid == -1){
         error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
-        $error = $error . ERR_USER . mysqli_real_escape_string($con, $_POST[GET_USER]);
+        $error = $error . ERR_USER . mysqli_real_escape_string($con, $_POST[POST_USER]);
         error_log($error);
         http_response_code(403); // Forbidden
         exit(-1);
@@ -117,11 +119,13 @@
 
     //Insert
     if (strlen($error) == 0){
-        mysqli_query($con, "INSERT INTO notification (user, title_es, title_en, title_eu, text_es, text_en, text_eu, action, duration) VALUES ($uid, '$title_es', '$title_en', '$title_eu', '$text_es', '$text_en', '$text_eu', '$action', $duration);");
+        mysqli_query($con, "INSERT INTO notification (user, title_es, title_en, title_eu, text_es, text_en, text_eu, action, duration) VALUES ($_SESSION[id], '$title_es', '$title_en', '$title_eu', '$text_es', '$text_en', '$text_eu', '$action', $duration);");
+        error_log("INSERT INTO notification (user, title_es, title_en, title_eu, text_es, text_en, text_eu, action, duration) VALUES ($_SESSION[id], '$title_es', '$title_en', '$title_eu', '$text_es', '$text_en', '$text_eu', '$action', $duration);");
         http_response_code(204); // No content;
         exit(0);
     }
     else{
+		http_response_code(400); // Bad request
         error_log($error);
         exit(-6);
     }

www-admin/API/v3/sync.php

@@ -1,36 +1,50 @@
  <?php
     // Gasteizko Margolariak API v3 //
 
+    // $_GET and $_POST valid parameters
+    define('POST_USER', 'user');
+    define('POST_PASS', 'pass');
+    define('GET_TABLES', 'tables');
+    define('GET_WHERE', 'where');
+
     // Error messages
     define('ERR_USER', '-USER:');
-    define('ERR_TABLE', '-TABLE:');
+    define('ERR_TABLES', '-TABLES:');
     define('ERR_WHERE', '-WHERE:');
 
-
-
-
     include('functions.php');
     $con = startdb();
+
     // Error control
     $error = "";
 
-    // Validate user/pass
-    if (!fastLogin($con)){
+    // Get params
+    $user = mysqli_real_escape_string($con, $_POST[POST_USER]);
+    $pass = mysqli_real_escape_string($con, $_POST[POST_PASS]);
+
+    $tables = mysqli_real_escape_string($con, $_GET[GET_TABLES]);
+    $where = mysqli_real_escape_string($con, $_GET[GET_WHERE]);
+
+    //Validate user
+    $uid = login($con, $user, $pass);
+    if ($uid == -1){
         error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
         $error = $error . ERR_USER . mysqli_real_escape_string($con, $_POST[GET_USER]);
         error_log($error);
         http_response_code(403); // Forbidden
         exit(-1);
     }
-	
-	// TODO: Ask server to create a SQLdump
-	$date = date_create();
-	$fname = date_timestamp_get($date);
-	include('../../.htpasswd');
-	exec("mysqldump gm -u $username_ro -p$pass_ro > /var/www-dump/$fname.sql");
-	// TODO: Ask server to encrypt the dump.
-	$pass = mysqli_real_escape_string($con, $_POST[GET_USER]);
-	exec("gpg --batch --yes --passphrase $pass -o /var/www-admin/dump/$fname.gpg -c /var/www-dump/$fname.sql.txt")
-	// TODO: Make a redirect for a redirect.
-	header("Location: /dump/$fname.gpg");
+
+    // Ask server to create a SQLdump
+    $date = date_create();
+    $fname = date_timestamp_get($date);
+    include('../../../www/.htpasswd');
+    exec("mysqldump --single-transaction gm -u $username_ro -p'$pass_ro' > /var/www-dump/$fname.sql");
+
+    // Ask server to encrypt the dump.
+    $pass = mysqli_real_escape_string($con, $_POST[POST_USER]);
+    exec("gpg --batch --yes --passphrase $pass -o /var/www-admin/dump/$fname.gpg -c /var/www-dump/$fname.sql");
+
+    // Make a redirect.
+    header("Location: /dump/$fname.gpg");
 ?>