jaredandClaude Opus 4.8
327c225ded
- ticket_dependencies.php: pass current user id/groups/is_admin into the visibility-filtered DependencyModel methods; drop (int) casts that stripped leading zeros from varchar ticket_ids - update_ticket.php: authorize visibility changes (admin or creator only); enforce requires_comment transitions server-side (400 + requires_comment flag so the client can prompt-and-retry); return proper 401/400/403 - add_comment.php: take commenter name from the session not the client (anti-spoofing); validate parent_comment_id belongs to the ticket; reject empty comments; pass ticket visibility to notifications so non-public comment bodies aren't leaked - add_comment/update_comment/bulk_operation: validate CSRF for all state-changing methods, not just POST - bootstrap.php: return the current CSRF token on rejection and never rotate it on a rejected request, so a desynced client can auto-recover - correct auth->401 and validation->400 status codes across these endpoints Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.3 KiB
PHP
73 lines
2.3 KiB
PHP
<?php
|
|
|
|
/**
|
|
* API Bootstrap - Common setup for API endpoints
|
|
*
|
|
* Provides: $conn, $currentUser, $userId, $isAdmin
|
|
*
|
|
* Usage:
|
|
* require_once __DIR__ . '/bootstrap.php';
|
|
* // $conn, $currentUser, $userId, $isAdmin are now available
|
|
*/
|
|
|
|
ini_set('display_errors', 0);
|
|
error_reporting(E_ALL);
|
|
|
|
// Rate limiting (also starts session)
|
|
require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
|
|
RateLimitMiddleware::apply('api');
|
|
|
|
// Config and database
|
|
require_once dirname(__DIR__) . '/config/config.php';
|
|
require_once dirname(__DIR__) . '/helpers/Database.php';
|
|
|
|
// Authentication check
|
|
if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
|
|
http_response_code(401);
|
|
header('Content-Type: application/json');
|
|
echo json_encode(['success' => false, 'error' => 'Authentication required']);
|
|
exit;
|
|
}
|
|
|
|
// CSRF protection for write requests
|
|
if (in_array($_SERVER['REQUEST_METHOD'], ['POST', 'PUT', 'DELETE'])) {
|
|
require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
|
|
$csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
|
|
if (!CsrfMiddleware::validateToken($csrfToken)) {
|
|
// Do NOT rotate on a rejected request. Return the current valid token so a
|
|
// client whose token drifted out of sync can recover on its next request
|
|
// (the response body is same-origin only, so this can't aid a CSRF attacker).
|
|
http_response_code(403);
|
|
header('Content-Type: application/json');
|
|
echo json_encode([
|
|
'success' => false,
|
|
'error' => 'Invalid CSRF token',
|
|
'csrf_token' => CsrfMiddleware::getToken()
|
|
]);
|
|
exit;
|
|
}
|
|
// Rotate token after successful validation; endpoints include it in their JSON response
|
|
$GLOBALS['_new_csrf_token'] = CsrfMiddleware::rotateToken();
|
|
}
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
// Common variables
|
|
$currentUser = $_SESSION['user'];
|
|
$userId = $currentUser['user_id'];
|
|
$isAdmin = $currentUser['is_admin'] ?? false;
|
|
$conn = Database::getConnection();
|
|
|
|
/**
|
|
* Output a JSON response, appending the rotated CSRF token so the
|
|
* client-side lt.api interceptor can update window.CSRF_TOKEN.
|
|
*/
|
|
function apiRespond(array $data): void
|
|
{
|
|
if (!empty($GLOBALS['_new_csrf_token'])) {
|
|
$data['csrf_token'] = $GLOBALS['_new_csrf_token'];
|
|
}
|
|
echo json_encode($data);
|
|
exit;
|
|
}
|