* Cherry pick 695055c6b1.

framework/api/entry.class.php

@@ -20,7 +20,7 @@ class entry extends baseEntry
 
         if($this->app->action == 'options') throw EndResponseException::create($this->send(204));
 
-        if(!isset($this->app->user) or $this->app->user->account == 'guest') throw EndResponseException::create($this->sendError(401, 'Unauthorized'));
+        if(!isset($this->app->user->account) or $this->app->user->account == 'guest') throw EndResponseException::create($this->sendError(401, 'Unauthorized'));
 
         $this->dao = $this->loadModel('common')->dao;
     }
@@ -708,7 +708,7 @@ class baseEntry
         $method = $this->app->getMethodName();
         if($module and $method and !$this->loadModel('common')->isOpenMethod($module, $method) and !commonModel::hasPriv($module, $method))
         {
-            return $this->send(403, array('error' => 'Access not allowed'));
+            die($this->send(403, array('error' => 'Access not allowed')));
         }
     }
 

framework/base/router.class.php

@@ -1166,16 +1166,15 @@ class baseRouter
 
         $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
 
-        /* Keep session if 'zentaosid'(session id) in $_GET. */
-        if(isset($_GET[$this->config->sessionVar]))
-        {
-            helper::restartSession($_GET[$this->config->sessionVar]);
-        }
-        elseif(isset($_SERVER['HTTP_TOKEN'])) // If request header has token, use it as session for authentication.
+        if(isset($_SERVER['HTTP_TOKEN'])) // If request header has token, use it as session for authentication.
         {
             helper::restartSession($_SERVER['HTTP_TOKEN']);
             $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
         }
+        elseif(isset($_GET[$this->config->sessionVar]))
+        {
+            helper::restartSession($_GET[$this->config->sessionVar]);
+        }
 
         define('SESSION_STARTED', true);
     }

module/common/model.php

@@ -1561,30 +1561,6 @@ class commonModel extends model
         return $convertedItems;
     }
 
-    /**
-     * 检查RESTful API调用是否合法。
-     * Check an entry of new API.
-     *
-     * @access public
-     * @return void
-     */
-    private function checkNewEntry()
-    {
-        $entry = $this->loadModel('entry')->getByKey(session_id());
-        if(!$entry or !$entry->account or !$this->checkIP($entry->ip)) return false;
-
-        $user = $this->dao->findByAccount($entry->account)->from(TABLE_USER)->andWhere('deleted')->eq(0)->fetch();
-        if(!$user) return false;
-
-        $user->last   = time();
-        $user->rights = $this->loadModel('user')->authorize($user->account);
-        $user->groups = $this->user->getGroups($user->account);
-        $user->view   = $this->user->grantUserView($user->account, $user->rights['acls']);
-        $user->admin  = strpos($this->app->company->admins, ",{$user->account},") !== false;
-        $this->session->set('user', $user);
-        $this->app->user = $user;
-    }
-
     /**
      * 检查旧版API调用是否合法。
      * Check an entry.
@@ -1594,13 +1570,6 @@ class commonModel extends model
      */
     public function checkEntry()
     {
-        /* if the API is new version, goto checkNewEntry. */
-        if($this->app->version)
-        {
-            if(!$this->checkNewEntry()) $this->response('INVALID_TOKEN');
-            return true;
-        }
-
         /* Old version. */
         if(!isset($_GET[$this->config->moduleVar]) or !isset($_GET[$this->config->methodVar])) $this->response('EMPTY_ENTRY');
         if($this->isOpenMethod($_GET[$this->config->moduleVar], $_GET[$this->config->methodVar])) return true;

www/api.php

@@ -33,15 +33,18 @@ $app = router::createApp('pms', dirname(dirname(__FILE__)), 'api');
 /* Run the app. */
 $common = $app->loadCommon();
 
-try
+if(!$app->version)
 {
-    /* Check entry. */
-    $common->checkEntry();
-}
-catch (EndResponseException $endResponseException)
-{
-    echo $endResponseException->getContent();
-    return print(helper::removeUTF8Bom(ob_get_clean()));
+    try
+    {
+        /* Check entry. */
+        $common->checkEntry();
+    }
+    catch (EndResponseException $endResponseException)
+    {
+        echo $endResponseException->getContent();
+        return print(helper::removeUTF8Bom(ob_get_clean()));
+    }
 }
 
 $common->loadConfigFromDB();