From f84d54558b14255033d79aed22071a1130cb21e8 Mon Sep 17 00:00:00 2001
From: DL6ER <derigs@ph1.uni-koeln.de>
Date: Sun, 20 Nov 2016 15:46:05 +0100
Subject: [PATCH] Allow GET hash for API calls

---
 api.php          | 13 +++++++------
 php/password.php |  6 ++++++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/api.php b/api.php
index d140958f..8bd37a2d 100644
--- a/api.php
+++ b/api.php
@@ -1,4 +1,5 @@
 <?php
+    $api = true;
     require "php/password.php";
 
     include('data.php');
@@ -31,29 +32,29 @@
         $data = array_merge($data,  getTopItems());
     }
 
-    // Requires authorization 
+    // Requires authorization
     if (isset($_GET['recentItems']) && $auth) {
         if (is_numeric($_GET['recentItems'])) {
             $data = array_merge($data,  getRecentItems($_GET['recentItems']));
         }
     }
 
-    // Requires authorization 
+    // Requires authorization
     if (isset($_GET['getQueryTypes']) && $auth) {
         $data = array_merge($data, getIpvType());
     }
 
-    // Requires authorization 
+    // Requires authorization
     if (isset($_GET['getForwardDestinations']) && $auth) {
         $data = array_merge($data, getForwardDestinations());
     }
 
-    // Requires authorization 
+    // Requires authorization
     if (isset($_GET['getQuerySources']) && $auth) {
         $data = array_merge($data, getQuerySources());
     }
-    
-    // Requires authorization 
+
+    // Requires authorization
     if (isset($_GET['getAllQueries']) && $auth) {
         $data = array_merge($data, getAllQueries());
     }
diff --git a/php/password.php b/php/password.php
index a023c0ee..6c5d8c96 100644
--- a/php/password.php
+++ b/php/password.php
@@ -26,6 +26,12 @@
             if($_SESSION["hash"] == $pwhash)
                 $auth = true;
         }
+        // API can use the hash to get data without logging in via plain-text password
+        else if (isset($api) && isset($_GET["auth"]))
+        {
+            if($_GET["auth"] == $pwhash)
+                $auth = true;
+        }
         else
         {
             // Password or hash wrong