From c3c9305775d9863cf194d9ddcf2de14cc7a45553 Mon Sep 17 00:00:00 2001
From: wangyidong <yidong@cnezsoft.com>
Date: Thu, 5 Jul 2018 14:58:46 +0800
Subject: [PATCH]  * finish task #4556.

---
 module/block/control.php |  5 ++++-
 module/block/model.php   | 21 +++++++++++++++++++++
 module/common/model.php  |  1 +
 module/sso/control.php   |  9 +++++----
 4 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/module/block/control.php b/module/block/control.php
index 4b34c27c33..87832fab3f 100644
--- a/module/block/control.php
+++ b/module/block/control.php
@@ -21,7 +21,7 @@ class block extends control
     {
         parent::__construct($moduleName, $methodName);
         /* Mark the call from zentao or ranzhi. */
-        $this->selfCall = !$this->server->http_referer || strpos($this->server->http_referer, common::getSysURL() . $this->config->webRoot) === 0 || $this->session->blockModule;
+        $this->selfCall = !isset($_GET['hash']);
         if($this->methodName != 'admin' and $this->methodName != 'dashboard' and !$this->selfCall and !$this->loadModel('sso')->checkKey()) die('');
     }
 
@@ -386,9 +386,12 @@ class block extends control
             $this->app->setClientLang($lang);
             $this->app->loadLang('common');
             $this->app->loadLang('block');
+
+            if(!$this->block->checkAPI($this->get->hash)) die();
         }
 
         $mode = strtolower($this->get->mode);
+
         if($mode == 'getblocklist')
         {
             $blocks = $this->block->getAvailableBlocks($module);
diff --git a/module/block/model.php b/module/block/model.php
index 59d10e1d72..45ef3f45cd 100644
--- a/module/block/model.php
+++ b/module/block/model.php
@@ -577,6 +577,27 @@ class blockModel extends model
      */
     public function isLongBlock($block)
     {
+        if(empty($block)) return true;
         return $block->grid >= 6;
     }
+
+    /**
+     * Check API for ranzhi
+     * 
+     * @param  string    $hash 
+     * @access public
+     * @return bool
+     */
+    public function checkAPI($hash)
+    {
+        if(empty($hash)) return false;
+
+        $key = $this->dao->select('value')->from(TABLE_CONFIG)
+            ->where('owner')->eq('system')
+            ->andWhere('module')->eq('sso')
+            ->andWhere('`key`')->eq('key')
+            ->fetch('value');
+
+        return $key == $hash;
+    }
 }
diff --git a/module/common/model.php b/module/common/model.php
index a80847c433..937e871ef6 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -159,6 +159,7 @@ class commonModel extends model
         if($module == 'sso' and $method == 'logout') return true;
         if($module == 'sso' and $method == 'bind') return true;
         if($module == 'sso' and $method == 'gettodolist') return true;
+        if($module == 'block' and $method == 'main' and isset($_GET['hash'])) return true;
         if($module == 'file' and $method == 'read') return true;
 
         if($this->loadModel('user')->isLogon() or ($this->app->company->guest and $this->app->user->account == 'guest'))
diff --git a/module/sso/control.php b/module/sso/control.php
index 2a9bb93d9e..e2eee29823 100644
--- a/module/sso/control.php
+++ b/module/sso/control.php
@@ -69,10 +69,11 @@ class sso extends control
 
                 $this->user->cleanLocked($user->account);
                 /* Authorize him and save to session. */
-                $user->rights = $this->user->authorize($user->account);
-                $user->groups = $this->user->getGroups($user->account);
-                $user->last   = date(DT_DATETIME1, $last);
-                $user->admin  = strpos($this->app->company->admins, ",{$user->account},") !== false;
+                $user->rights   = $this->user->authorize($user->account);
+                $user->groups   = $this->user->getGroups($user->account);
+                $user->last     = date(DT_DATETIME1, $last);
+                $user->lastTime = $user->last;
+                $user->admin    = strpos($this->app->company->admins, ",{$user->account},") !== false;
                 $user->modifyPassword = ($user->visits == 0 and !empty($this->config->safe->modifyPasswordFirstLogin));
                 if($user->modifyPassword) $user->modifyPasswordReason = 'modifyPasswordFirstLogin';
                 if(!$user->modifyPassword and !empty($this->config->safe->changeWeak))