Allowed API insta-login via HTTP Basic Auth (#3443)

OpenMage · Aug 17, 2023 · 8e5cc7f · 8e5cc7f
1 parent 9f331f6
commit 8e5cc7f
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/app/code/core/Mage/Api/Model/Server/Handler/Abstract.php b/app/code/core/Mage/Api/Model/Server/Handler/Abstract.php
@@ -225,6 +225,10 @@ public function login($username, $apiKey = null)
      */
     public function call($sessionId, $apiPath, $args = [])
     {
+        // Allow insta-login via HTTP Basic Auth
+        if ($sessionId === null && ! empty($_SERVER['PHP_AUTH_USER']) && ! empty($_SERVER['PHP_AUTH_PW'])) {
+            $sessionId = $this->login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
+        }
         $this->_startSession($sessionId);
 
         if (!$this->_getSession()->isLoggedIn($sessionId)) {
@@ -309,6 +313,10 @@ public function call($sessionId, $apiPath, $args = [])
      */
     public function multiCall($sessionId, array $calls = [], $options = [])
     {
+        // Allow insta-login via HTTP Basic Auth
+        if ($sessionId === null && ! empty($_SERVER['PHP_AUTH_USER']) && ! empty($_SERVER['PHP_AUTH_PW'])) {
+            $sessionId = $this->login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
+        }
         $this->_startSession($sessionId);
 
         if (!$this->_getSession()->isLoggedIn($sessionId)) {
@@ -437,6 +445,10 @@ public function multiCall($sessionId, array $calls = [], $options = [])
      */
     public function resources($sessionId)
     {
+        // Allow insta-login via HTTP Basic Auth
+        if ($sessionId === null && ! empty($_SERVER['PHP_AUTH_USER']) && ! empty($_SERVER['PHP_AUTH_PW'])) {
+            $sessionId = $this->login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
+        }
         $this->_startSession($sessionId);
 
         if (!$this->_getSession()->isLoggedIn($sessionId)) {
@@ -501,6 +513,10 @@ public function resources($sessionId)
      */
     public function resourceFaults($sessionId, $resourceName)
     {
+        // Allow insta-login via HTTP Basic Auth
+        if ($sessionId === null && ! empty($_SERVER['PHP_AUTH_USER']) && ! empty($_SERVER['PHP_AUTH_PW'])) {
+            $sessionId = $this->login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
+        }
         $this->_startSession($sessionId);
 
         if (!$this->_getSession()->isLoggedIn($sessionId)) {
@@ -537,6 +553,10 @@ public function resourceFaults($sessionId, $resourceName)
      */
     public function globalFaults($sessionId)
     {
+        // Allow insta-login via HTTP Basic Auth
+        if ($sessionId === null && ! empty($_SERVER['PHP_AUTH_USER']) && ! empty($_SERVER['PHP_AUTH_PW'])) {
+            $sessionId = $this->login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
+        }
         $this->_startSession($sessionId);
         return array_values($this->_getConfig()->getFaults());
     }