* finish task #4556.

module/block/control.php

@@ -21,7 +21,7 @@ class block extends control
     {
         parent::__construct($moduleName, $methodName);
         /* Mark the call from zentao or ranzhi. */
-        $this->selfCall = !$this->server->http_referer || strpos($this->server->http_referer, common::getSysURL() . $this->config->webRoot) === 0 || $this->session->blockModule;
+        $this->selfCall = !isset($_GET['hash']);
         if($this->methodName != 'admin' and $this->methodName != 'dashboard' and !$this->selfCall and !$this->loadModel('sso')->checkKey()) die('');
     }
 
@@ -386,9 +386,12 @@ class block extends control
             $this->app->setClientLang($lang);
             $this->app->loadLang('common');
             $this->app->loadLang('block');
+
+            if(!$this->block->checkAPI($this->get->hash)) die();
         }
 
         $mode = strtolower($this->get->mode);
+
         if($mode == 'getblocklist')
         {
             $blocks = $this->block->getAvailableBlocks($module);

module/block/model.php

@@ -577,6 +577,27 @@ class blockModel extends model
      */
     public function isLongBlock($block)
     {
+        if(empty($block)) return true;
         return $block->grid >= 6;
     }
+
+    /**
+     * Check API for ranzhi
+     * 
+     * @param  string    $hash 
+     * @access public
+     * @return bool
+     */
+    public function checkAPI($hash)
+    {
+        if(empty($hash)) return false;
+
+        $key = $this->dao->select('value')->from(TABLE_CONFIG)
+            ->where('owner')->eq('system')
+            ->andWhere('module')->eq('sso')
+            ->andWhere('`key`')->eq('key')
+            ->fetch('value');
+
+        return $key == $hash;
+    }
 }

module/common/model.php

@@ -159,6 +159,7 @@ class commonModel extends model
         if($module == 'sso' and $method == 'logout') return true;
         if($module == 'sso' and $method == 'bind') return true;
         if($module == 'sso' and $method == 'gettodolist') return true;
+        if($module == 'block' and $method == 'main' and isset($_GET['hash'])) return true;
         if($module == 'file' and $method == 'read') return true;
 
         if($this->loadModel('user')->isLogon() or ($this->app->company->guest and $this->app->user->account == 'guest'))

module/sso/control.php

@@ -69,10 +69,11 @@ class sso extends control
 
                 $this->user->cleanLocked($user->account);
                 /* Authorize him and save to session. */
-                $user->rights = $this->user->authorize($user->account);
-                $user->groups = $this->user->getGroups($user->account);
-                $user->last   = date(DT_DATETIME1, $last);
-                $user->admin  = strpos($this->app->company->admins, ",{$user->account},") !== false;
+                $user->rights   = $this->user->authorize($user->account);
+                $user->groups   = $this->user->getGroups($user->account);
+                $user->last     = date(DT_DATETIME1, $last);
+                $user->lastTime = $user->last;
+                $user->admin    = strpos($this->app->company->admins, ",{$user->account},") !== false;
                 $user->modifyPassword = ($user->visits == 0 and !empty($this->config->safe->modifyPasswordFirstLogin));
                 if($user->modifyPassword) $user->modifyPasswordReason = 'modifyPasswordFirstLogin';
                 if(!$user->modifyPassword and !empty($this->config->safe->changeWeak))