composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-05-19 15:22:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°8612 - force authentication for inline image endpoints

Browse Source 
- ajax.render dict route needs to be reached without login authentication
This commit is contained in:
Benjamin DALSASS
2026-03-23 15:49:04 +01:00
parent c61b21559c
commit 458a996c29
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pages/ajax.document.php
View File

@@ -34,7 +34,6 @@ try {
require_once(APPROOT.'/application/startup.inc.php'); require_once(APPROOT.'/application/startup.inc.php');
require_once(APPROOT.'/application/loginwebpage.class.inc.php'); require_once(APPROOT.'/application/loginwebpage.class.inc.php');
LoginWebPage::DoLoginEx();
IssueLog::Trace('----- Request: '.utils::GetRequestUri(), LogChannels::WEB_REQUEST); IssueLog::Trace('----- Request: '.utils::GetRequestUri(), LogChannels::WEB_REQUEST);
@@ -45,6 +44,7 @@ try {
switch ($operation) { switch ($operation) {
case 'download_document': case 'download_document':
LoginWebPage::DoLoginEx();
$id = utils::ReadParam('id', ''); $id = utils::ReadParam('id', '');
$sField = utils::ReadParam('field', ''); $sField = utils::ReadParam('field', '');
if ($sClass == 'Attachment') { if ($sClass == 'Attachment') {
@@ -64,6 +64,7 @@ try {
break; break;
case 'download_inlineimage': case 'download_inlineimage':
LoginWebPage::DoLoginEx();
$id = utils::ReadParam('id', ''); $id = utils::ReadParam('id', '');
$sSecret = utils::ReadParam('s', ''); $sSecret = utils::ReadParam('s', '');
$iCacheSec = 31556926; // One year ahead: an inline image cannot change $iCacheSec = 31556926; // One year ahead: an inline image cannot change