projekt kivitendo

  # The session ID provided is valid in the following cases:

  #  1. session ID exists in the database

  #  2. hasn't expired yet

  #  3. if form field '{AUTH}api_token' is given: form field must equal database column 'auth.session.api_token' for the session ID

  #  4. if form field '{AUTH}api_token' is NOT given then: the requestee's IP address must match the stored IP address

  $self->{api_token}   = $cookie->{api_token} if $cookie;

  my $api_token_cookie = $self->get_api_token_cookie;

  my $cookie_is_bad    = !$cookie || $cookie->{is_expired};

  $cookie_is_bad     ||= $api_token_cookie && ($api_token_cookie ne $cookie->{api_token}) if  $api_token_cookie;

  $cookie_is_bad     ||= $cookie->{ip_address} ne $ENV{REMOTE_ADDR}                       if !$api_token_cookie;

  if ($cookie_is_bad) {

  if ($self->{column_information}->has('api_token', 'session')) {

    my ($stored_api_token) = $dbh->selectrow_array(qq|SELECT api_token FROM auth.session WHERE id = ?|, undef, $session_id);

    do_query($::form, $dbh, qq|UPDATE auth.session SET api_token = ? WHERE id = ?|, $self->_create_session_id, $session_id) unless $stored_api_token;

  }

  my ($self, %params) = @_;

  $params{type}     ||= 'id';

  my $name            = $self->{cookie_name} || 'lx_office_erp_session_id';

  $name              .= '_api_token' if $params{type} eq 'api_token';

  return $name;

sub get_api_token_cookie {

  my ($self) = @_;

  $::request->{cgi}->cookie($self->get_session_cookie_name(type => 'api_token'));

}