johnnyq
04bf3c234f
Read API credential decrypt password from body instead of query string
...
Keeps the credential decryption secret out of the URL, so it no longer lands in web-server access logs, proxy logs, or browser history. credentials/read.php now reads api_key_decrypt_password from the request body, matching create/update. Consumers reading decrypted credentials must send it in the body, not the query string.
2026-07-25 17:08:22 -04:00
johnnyq
c509b7f693
Add user-based RBAC for API keys
...
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
2026-07-25 16:50:58 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
319ccbad01
Revert "API: Add some missing end points"
...
This reverts commit c4ba2bc326
2026-04-16 15:16:08 -04:00
johnnyq
c4ba2bc326
API: Add some missing end points
2026-04-11 18:21:03 -04:00
wrongecho
20be416fa6
API
...
- Fix credential errors since field names changed
- Sort domains properly
2026-04-04 11:20:52 +01:00
wrongecho
4617f44cda
- Prevent error 500s when existing data can't be cleanly re-inserted to database
2026-04-04 11:01:34 +01:00
wrongecho
c0b7a26905
API bugfixes before release:
...
- apiEncryptLoginEntry should be apiEncryptCredentialEntry
- Client scoping uses = instead of LIKE in tickets resolve.php
2026-01-28 14:48:41 +00:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
johnnyq
f1783a6110
update credential model
2025-03-12 22:35:13 -04:00
johnnyq
c8c1155c9c
Update the API for the new cred var names
2025-03-12 22:33:06 -04:00
johnnyq
e9f023f0c7
Updated all API functions to use the new logAction Function
2024-11-14 18:27:31 -05:00
wrongecho
ec0e1c395c
Tweak credentials read api
2024-08-25 20:29:14 +01:00
wrongecho
24ff6f5c84
WIP: Allow decrypting logins/credentials via the API
2024-08-25 12:45:18 +01:00
wrongecho
9ef3099495
WIP: Allow decrypting logins/credentials via the API
2024-08-25 12:32:21 +01:00
wrongecho
d37bdcdbcb
WIP: Allow decrypting logins/credentials via the API
2024-08-25 12:31:15 +01:00
wrongecho
a6113dc371
WIP: Allow decrypting logins/credentials via the API
2024-08-22 18:22:20 +01:00
wrongecho
0c60ecc329
WIP: Allow decrypting logins/credentials via the API
2024-08-22 17:46:58 +01:00
wrongecho
63feff03d2
Initial WIP: Allow decrypting logins/credentials via the API
2024-08-19 21:23:43 +01:00
