* Fix bug for api priv check.

framework/api/entry.class.php

@@ -20,7 +20,7 @@ class entry extends baseEntry
 
         if($this->app->action == 'options') throw EndResponseException::create($this->send(204));
 
-        if(!isset($this->app->user) or $this->app->user->account == 'guest') throw EndResponseException::create($this->sendError(401, 'Unauthorized'));
+        if(!isset($this->app->user->account) or $this->app->user->account == 'guest') throw EndResponseException::create($this->sendError(401, 'Unauthorized'));
 
         $this->dao = $this->loadModel('common')->dao;
     }
@@ -713,7 +713,7 @@ class baseEntry
         $method = $this->app->getMethodName();
         if($module and $method and !$this->loadModel('common')->isOpenMethod($module, $method) and !commonModel::hasPriv($module, $method))
         {
-            return $this->send(403, array('error' => 'Access not allowed'));
+            die($this->send(403, array('error' => 'Access not allowed')));
         }
     }
 

framework/base/router.class.php

@@ -1120,15 +1120,15 @@ class baseRouter
 
         $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
 
-        if(isset($_GET[$this->config->sessionVar]))
-        {
-            helper::restartSession($_GET[$this->config->sessionVar]);
-        }
-        else if(isset($_SERVER['HTTP_TOKEN'])) // If request header has token, use it as session for authentication.
+        if(isset($_SERVER['HTTP_TOKEN'])) // If request header has token, use it as session for authentication.
         {
             helper::restartSession($_SERVER['HTTP_TOKEN']);
             $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
         }
+        elseif(isset($_GET[$this->config->sessionVar]))
+        {
+            helper::restartSession($_GET[$this->config->sessionVar]);
+        }
 
         define('SESSION_STARTED', true);
     }

module/common/model.php

@@ -3022,29 +3022,6 @@ EOF;
         return $convertedItems;
     }
 
-    /**
-     * Check an entry of new API.
-     *
-     * @access public
-     * @return void
-     */
-    private function checkNewEntry()
-    {
-        $entry = $this->loadModel('entry')->getByKey(session_id());
-        if(!$entry or !$entry->account or !$this->checkIP($entry->ip)) return false;
-
-        $user = $this->dao->findByAccount($entry->account)->from(TABLE_USER)->andWhere('deleted')->eq(0)->fetch();
-        if(!$user) return false;
-
-        $user->last   = time();
-        $user->rights = $this->loadModel('user')->authorize($user->account);
-        $user->groups = $this->user->getGroups($user->account);
-        $user->view   = $this->user->grantUserView($user->account, $user->rights['acls']);
-        $user->admin  = strpos($this->app->company->admins, ",{$user->account},") !== false;
-        $this->session->set('user', $user);
-        $this->app->user = $user;
-    }
-
     /**
      * Check an entry.
      *
@@ -3053,13 +3030,6 @@ EOF;
      */
     public function checkEntry()
     {
-        /* if the API is new version, goto checkNewEntry. */
-        if($this->app->version)
-        {
-            if(!$this->checkNewEntry()) $this->response('INVALID_TOKEN');
-            return true;
-        }
-
         /* Old version. */
         if(!isset($_GET[$this->config->moduleVar]) or !isset($_GET[$this->config->methodVar])) $this->response('EMPTY_ENTRY');
         if($this->isOpenMethod($_GET[$this->config->moduleVar], $_GET[$this->config->methodVar])) return true;

www/api.php

@@ -34,7 +34,7 @@ $app = router::createApp('pms', dirname(dirname(__FILE__)), 'api');
 $common = $app->loadCommon();
 
 /* Check entry. */
-$common->checkEntry();
+if(!$app->version) $common->checkEntry();
 $common->loadConfigFromDB();
 
 /* Set default params. */