From c575a429d5630aaafbb89eda51687b5cc0331524 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=AE=8B=E8=BE=B0=E8=BD=A9?= <songchenxuan@easycorp.ltd>
Date: Wed, 10 Apr 2024 15:15:00 +0800
Subject: [PATCH] * Cherry pick 695055c6b1.

---
 framework/api/entry.class.php   |  4 ++--
 framework/base/router.class.php | 11 +++++------
 module/common/model.php         | 31 -------------------------------
 www/api.php                     | 19 +++++++++++--------
 4 files changed, 18 insertions(+), 47 deletions(-)

diff --git a/framework/api/entry.class.php b/framework/api/entry.class.php
index 55b76125dd..3c5bf8abbd 100644
--- a/framework/api/entry.class.php
+++ b/framework/api/entry.class.php
@@ -20,7 +20,7 @@ class entry extends baseEntry
 
         if($this->app->action == 'options') throw EndResponseException::create($this->send(204));
 
-        if(!isset($this->app->user) or $this->app->user->account == 'guest') throw EndResponseException::create($this->sendError(401, 'Unauthorized'));
+        if(!isset($this->app->user->account) or $this->app->user->account == 'guest') throw EndResponseException::create($this->sendError(401, 'Unauthorized'));
 
         $this->dao = $this->loadModel('common')->dao;
     }
@@ -708,7 +708,7 @@ class baseEntry
         $method = $this->app->getMethodName();
         if($module and $method and !$this->loadModel('common')->isOpenMethod($module, $method) and !commonModel::hasPriv($module, $method))
         {
-            return $this->send(403, array('error' => 'Access not allowed'));
+            die($this->send(403, array('error' => 'Access not allowed')));
         }
     }
 
diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index 1af11fdbe7..a6a27857fb 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -1166,16 +1166,15 @@ class baseRouter
 
         $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
 
-        /* Keep session if 'zentaosid'(session id) in $_GET. */
-        if(isset($_GET[$this->config->sessionVar]))
-        {
-            helper::restartSession($_GET[$this->config->sessionVar]);
-        }
-        elseif(isset($_SERVER['HTTP_TOKEN'])) // If request header has token, use it as session for authentication.
+        if(isset($_SERVER['HTTP_TOKEN'])) // If request header has token, use it as session for authentication.
         {
             helper::restartSession($_SERVER['HTTP_TOKEN']);
             $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
         }
+        elseif(isset($_GET[$this->config->sessionVar]))
+        {
+            helper::restartSession($_GET[$this->config->sessionVar]);
+        }
 
         define('SESSION_STARTED', true);
     }
diff --git a/module/common/model.php b/module/common/model.php
index f61b39e111..2404082100 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -1561,30 +1561,6 @@ class commonModel extends model
         return $convertedItems;
     }
 
-    /**
-     * 检查RESTful API调用是否合法。
-     * Check an entry of new API.
-     *
-     * @access public
-     * @return void
-     */
-    private function checkNewEntry()
-    {
-        $entry = $this->loadModel('entry')->getByKey(session_id());
-        if(!$entry or !$entry->account or !$this->checkIP($entry->ip)) return false;
-
-        $user = $this->dao->findByAccount($entry->account)->from(TABLE_USER)->andWhere('deleted')->eq(0)->fetch();
-        if(!$user) return false;
-
-        $user->last   = time();
-        $user->rights = $this->loadModel('user')->authorize($user->account);
-        $user->groups = $this->user->getGroups($user->account);
-        $user->view   = $this->user->grantUserView($user->account, $user->rights['acls']);
-        $user->admin  = strpos($this->app->company->admins, ",{$user->account},") !== false;
-        $this->session->set('user', $user);
-        $this->app->user = $user;
-    }
-
     /**
      * 检查旧版API调用是否合法。
      * Check an entry.
@@ -1594,13 +1570,6 @@ class commonModel extends model
      */
     public function checkEntry()
     {
-        /* if the API is new version, goto checkNewEntry. */
-        if($this->app->version)
-        {
-            if(!$this->checkNewEntry()) $this->response('INVALID_TOKEN');
-            return true;
-        }
-
         /* Old version. */
         if(!isset($_GET[$this->config->moduleVar]) or !isset($_GET[$this->config->methodVar])) $this->response('EMPTY_ENTRY');
         if($this->isOpenMethod($_GET[$this->config->moduleVar], $_GET[$this->config->methodVar])) return true;
diff --git a/www/api.php b/www/api.php
index 7df0bfac68..f15d5e49f4 100644
--- a/www/api.php
+++ b/www/api.php
@@ -33,15 +33,18 @@ $app = router::createApp('pms', dirname(dirname(__FILE__)), 'api');
 /* Run the app. */
 $common = $app->loadCommon();
 
-try
+if(!$app->version)
 {
-    /* Check entry. */
-    $common->checkEntry();
-}
-catch (EndResponseException $endResponseException)
-{
-    echo $endResponseException->getContent();
-    return print(helper::removeUTF8Bom(ob_get_clean()));
+    try
+    {
+        /* Check entry. */
+        $common->checkEntry();
+    }
+    catch (EndResponseException $endResponseException)
+    {
+        echo $endResponseException->getContent();
+        return print(helper::removeUTF8Bom(ob_get_clean()));
+    }
 }
 
 $common->loadConfigFromDB();