From e5aa646144ea0145c5ec2f88fcefc11428b87aa6 Mon Sep 17 00:00:00 2001
From: zhujinyong <zhujinyong@cnezsoft.com>
Date: Thu, 3 Nov 2022 10:03:19 +0800
Subject: [PATCH] * Fix session for api.

---
 framework/base/router.class.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index d99a03afde..bb3fe8f834 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -1014,9 +1014,6 @@ class baseRouter
         if($this->config->customSession) session_save_path($this->getTmpRoot() . 'session');
         if(!session_id()) session_start();
 
-        /* If request header has token, use it as session for authentication. */
-        if(isset($_SERVER['HTTP_TOKEN'])) session_id($_SERVER['HTTP_TOKEN']);
-
         $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
 
         if(isset($_GET[$this->config->sessionVar]))
@@ -1024,6 +1021,11 @@ class baseRouter
             helper::restartSession($_GET[$this->config->sessionVar]);
             $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
         }
+        else if(isset($_SERVER['HTTP_TOKEN'])) // If request header has token, use it as session for authentication.
+        {
+            helper::restartSession($_SERVER['HTTP_TOKEN']);
+            $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
+        }
 
         define('SESSION_STARTED', true);
     }