diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php index 0889abbd..51706a1a 100644 --- a/api/v1/credentials/read.php +++ b/api/v1/credentials/read.php @@ -4,17 +4,49 @@ require_once '../validate_api_key.php'; require_once '../require_get_method.php'; +// Default +$sql = false; // Specific credential/login via ID (single) -if (isset($_GET['login_id'])) { - $id = intval($_GET['login_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$id' AND login_client_id LIKE '$client_id'"); +if (isset($_GET['login_id']) && isset($_GET['api_key_decrypt_password'])) { -} else { + $id = intval($_GET['login_id']); + $password = sanitizeInput($_GET['api_key_decrypt_password']); + + $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$id' AND login_client_id LIKE '$client_id' LIMIT 1"); + + +} elseif (isset($_GET['api_key_decrypt_password'])) { // All credentials ("logins") $sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_client_id LIKE '$client_id' ORDER BY login_id LIMIT $limit OFFSET $offset"); + } -// Output -require_once "../read_output.php"; +// Output - Not using the standard API read_output.php +// Usually we just output what is in the database, but credentials need to be decrypted first. +if ($sql && mysqli_num_rows($sql) > 0) { + $return_arr['success'] = "True"; + $return_arr['count'] = mysqli_num_rows($sql); + + $row = array(); + while ($row = mysqli_fetch_array($sql)) { + //$row['login_username'] = //decrypt + $return_arr['data'][] = $row; + } + + echo json_encode($return_arr); + exit(); +} +else { + $return_arr['success'] = "False"; + $return_arr['message'] = "No resource (for this client and company) with the specified parameter(s)."; + + // Log any database/schema related errors to the PHP Error log + if (mysqli_error($mysqli)) { + error_log("API Database Error: " . mysqli_error($mysqli)); + } + + echo json_encode($return_arr); + exit(); +} \ No newline at end of file diff --git a/database_updates.php b/database_updates.php index 2e13d973..257b7c6b 100644 --- a/database_updates.php +++ b/database_updates.php @@ -2126,7 +2126,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { } if (CURRENT_DATABASE_VERSION == '1.4.4') { - mysqli_query($mysqli, "ALTER TABLE `api_keys` ADD `api_key_credential_decryption_password` VARCHAR(200) NOT NULL AFTER `api_key_secret`"); + mysqli_query($mysqli, "ALTER TABLE `api_keys` ADD `api_key_decrypt_hash` VARCHAR(200) NOT NULL AFTER `api_key_secret`"); mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.4.5'"); } diff --git a/database_version.php b/database_version.php index 97947f7b..02ae2a6a 100644 --- a/database_version.php +++ b/database_version.php @@ -5,4 +5,4 @@ * It is used in conjunction with database_updates.php */ -DEFINE("LATEST_DATABASE_VERSION", "1.4.4"); +DEFINE("LATEST_DATABASE_VERSION", "1.4.5"); diff --git a/db.sql b/db.sql index c3ab550d..2b4ba70f 100644 --- a/db.sql +++ b/db.sql @@ -66,7 +66,7 @@ CREATE TABLE `api_keys` ( `api_key_id` int(11) NOT NULL AUTO_INCREMENT, `api_key_name` varchar(255) NOT NULL, `api_key_secret` varchar(255) NOT NULL, - `api_key_credential_decryption_password` varchar(255) NULL, + `api_key_decrypt_hash` varchar(255) NULL, `api_key_created_at` datetime NOT NULL DEFAULT current_timestamp(), `api_key_expire` date NOT NULL, `api_key_client_id` int(11) NOT NULL DEFAULT 0, diff --git a/functions.php b/functions.php index f852e0f7..3e39c957 100644 --- a/functions.php +++ b/functions.php @@ -297,7 +297,7 @@ function encryptUserSpecificKey($user_password) return $salt . $iv . $ciphertext; } -// Given a ciphertext (incl. IV) and the user's password, returns the site master key +// Given a ciphertext (incl. IV) and the user's (or API key) password, returns the site master key // Ran at login, to facilitate generateUserSessionKey function decryptUserSpecificKey($user_encryption_ciphertext, $user_password) { diff --git a/post/api.php b/post/api.php index 16529d77..1224a59e 100644 --- a/post/api.php +++ b/post/api.php @@ -20,7 +20,7 @@ if (isset($_POST['add_api_key'])) { $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT); $apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password'])); - mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_expire = '$expire', api_key_client_id = $client"); + mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client"); $api_key_id = mysqli_insert_id($mysqli);