fix(api): restrict file and package download to the API only

flyve-mdm · Jul 27, 2017 · b2b5bec · b2b5bec
1 parent 84be562
commit b2b5bec
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/inc/file.class.php b/inc/file.class.php
@@ -321,8 +321,9 @@ public function post_addItem() {
    public function post_getFromDB() {
       // Check the user can view this itemtype and can view this item
       if ($this->canView() && $this->canViewItem()) {
-         if (isset($_SERVER['HTTP_ACCEPT']) && $_SERVER['HTTP_ACCEPT'] == 'application/octet-stream'
-               || isset($_GET['alt']) && $_GET['alt'] == 'media') {
+         if (isAPI()
+             && (isset($_SERVER['HTTP_ACCEPT']) && $_SERVER['HTTP_ACCEPT'] == 'application/octet-stream'
+                 || isset($_GET['alt']) && $_GET['alt'] == 'media')) {
             $this->sendFile(); // and terminate script
          }
       }

diff --git a/inc/package.class.php b/inc/package.class.php
@@ -367,8 +367,9 @@ public function prepareInputForUpdate($input) {
    public function post_getFromDB() {
       // Check the user can view this itemtype and can view this item
       if ($this->canView() && $this->canViewItem()) {
-         if (isset($_SERVER['HTTP_ACCEPT']) && $_SERVER['HTTP_ACCEPT'] == 'application/octet-stream'
-               || isset($_GET['alt']) && $_GET['alt'] == 'media') {
+         if (isAPI()
+             && (isset($_SERVER['HTTP_ACCEPT']) && $_SERVER['HTTP_ACCEPT'] == 'application/octet-stream'
+                 || isset($_GET['alt']) && $_GET['alt'] == 'media')) {
             $this->sendFile(); // and terminate script
          }
       }