projekt kivitendo

  # The session ID provided is valid in the following cases:

  #  1. session ID exists in the database

  #  2. hasn't expired yet

  #  3. if form field '{AUTH}api_token' is given: form field must equal database column 'auth.session.api_token' for the session ID

  #  4. if form field '{AUTH}api_token' is NOT given then: the requestee's IP address must match the stored IP address

  $self->{api_token}   = $cookie->{api_token} if $cookie;

  my $api_token_cookie = $self->get_api_token_cookie;

  my $cookie_is_bad    = !$cookie || $cookie->{is_expired};

  $cookie_is_bad     ||= $api_token_cookie && ($api_token_cookie ne $cookie->{api_token}) if  $api_token_cookie;

  $cookie_is_bad     ||= $cookie->{ip_address} ne $ENV{REMOTE_ADDR}                       if !$api_token_cookie;

  if ($cookie_is_bad) {

  if ($self->{column_information}->has('api_token', 'session')) {

    my ($stored_api_token) = $dbh->selectrow_array(qq|SELECT api_token FROM auth.session WHERE id = ?|, undef, $session_id);

    do_query($::form, $dbh, qq|UPDATE auth.session SET api_token = ? WHERE id = ?|, $self->_create_session_id, $session_id) unless $stored_api_token;

  }

  my ($self, %params) = @_;

  $params{type}     ||= 'id';

  my $name            = $self->{cookie_name} || 'lx_office_erp_session_id';

  $name              .= '_api_token' if $params{type} eq 'api_token';

  return $name;

sub get_api_token_cookie {

  my ($self) = @_;

  $::request->{cgi}->cookie($self->get_session_cookie_name(type => 'api_token'));

}

  $self->{info} = {};

  foreach my $table (qw(session session_content)) {

    my $query = <<SQL;

      SELECT a.attname, format_type(a.atttypid, a.atttypmod) AS format_type, d.adsrc, a.attnotnull

      FROM pg_attribute a

      LEFT JOIN pg_attrdef d ON (a.attrelid = d.adrelid) AND (a.attnum = d.adnum)

      WHERE (a.attrelid = 'auth.${table}'::regclass)

        AND (a.attnum > 0)

        AND NOT a.attisdropped

      ORDER BY a.attnum

    $self->{info}->{$table} = { selectall_as_map($::form, $self->{auth}->dbconnect, $query, 'attname', [ qw(format_type adsrc attnotnull) ]) };

  }

  my ($self, $column, $table) = @_;

  return $self->info->{$table || 'session_content'}->{$column};

  my $login        = $::form->{'{AUTH}login'} || $::auth->get_session_value('login');

  %::myconfig      = $login ? $::auth->read_user(login => $login) : ();

  SL::Dispatcher::AuthHandler::User->new->handle(countrycode => $::myconfig{countrycode});

  return 1 if  $::auth->get_api_token_cookie;

  my $ok   =  $::auth->get_api_token_cookie ? 1 : 0;

  $ok    ||=  $::form->{'{AUTH}login'} && (SL::Auth::OK() == $::auth->authenticate($::myconfig{login}, $::form->{'{AUTH}password'}));

-- @tag: add_api_token

-- @description: Feld 'api_token' in 'session' ergänzen

-- @depends:

-- @charset: utf-8

ALTER TABLE auth.session ADD COLUMN api_token text;