Files
archived-web-bugs/www/rpc.php
Nikita Popov 381dea4249 Directly check token for rpc.php
Make this code independent of user authentication by checking
for a hardcoded token.
2021-04-05 23:02:03 +02:00

92 lines
2.6 KiB
PHP

<?php
use App\Repository\BugRepository;
/**
* This API page is used by https://svn.php.net/viewvc/SVNROOT/commit-bugs.php
* to manage bugs automatically.
*/
session_start();
$bug_id = (isset($_REQUEST['id']) ? (int) $_REQUEST['id'] : 0);
if (!$bug_id) {
echo json_encode(['result' => ['error' => 'Missing bug id']]);
exit;
}
// Obtain common includes
require_once '../include/prepend.php';
if (!isset($_POST['MAGIC_COOKIE'])) {
echo json_encode(['result' => ['error' => 'Missing token']]);
exit;
}
if (sha1($_POST['MAGIC_COOKIE']) !== '8514f801cfba2ec74ec08264567ba291485f2765') {
echo json_encode(['result' => ['error' => 'Invalid token']]);
exit;
}
// fetch info about the bug into $bug
$bugRepository = $container->get(BugRepository::class);
$bug = $bugRepository->findOneById($bug_id);
if (!is_array($bug)) {
echo json_encode(['result' => ['error' => 'No such bug']]);
exit;
}
// Be conservative: Do not allow access to private bugs.
if ($bug['private'] === 'Y') {
echo json_encode(['result' => ['error' => 'No access to bug']]);
exit;
}
if (!empty($_POST['ncomment']) && !empty($_POST['user'])) {
$user = htmlspecialchars(trim($_POST['user']));
$ncomment = htmlspecialchars(trim($_POST['ncomment']));
$from = "{$user}@php.net";
try {
/* svn log comment */
bugs_add_comment($bug_id, $from, $user, $ncomment, 'svn');
/* Close the bug report as requested if it is not already closed */
if (!empty($_POST['status'])
&& $bug['status'] !== 'Closed'
&& $_POST['status'] === 'Closed') {
/* Change the bug status to Closed */
bugs_status_change($bug_id, 'Closed');
$in = $bug;
/* Just change the bug status */
$in['status'] = $_POST['status'];
$changed = bug_diff($bug, $in);
if (!empty($changed)) {
$log_comment = bug_diff_render_html($changed);
if (!empty($log_comment)) {
/* Add a log of status change */
bugs_add_comment($bug_id, $from, '', $log_comment, 'log');
}
}
/* Send a mail notification when automatically closing a bug */
mail_bug_updates($bug, $in, $from, $ncomment, 1, $bug_id);
}
echo json_encode(['result' => ['status' => $bug]]);
exit;
} catch (Exception $e) {
echo json_encode(['result' => ['error' => $e->getMessage()]]);
exit;
}
} else if (!empty($_POST['getbug'])) {
echo json_encode(['result' => ['status' => $bug]]);
exit;
}
echo json_encode(['result' => ['error' => 'Nothing to do']]);