From f8417cd3aa92f49cbe98188cd6fca2ec50da9613 Mon Sep 17 00:00:00 2001
From: Florian Pritz <bluewind@xinu.at>
Date: Wed, 28 Aug 2013 00:08:29 +0200
Subject: muser: always verify api credentials; improve error messages

Signed-off-by: Florian Pritz <bluewind@xinu.at>
---
 application/models/muser.php | 35 ++++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

(limited to 'application/models/muser.php')

diff --git a/application/models/muser.php b/application/models/muser.php
index 843b7cad6..b3c16bf78 100644
--- a/application/models/muser.php
+++ b/application/models/muser.php
@@ -67,14 +67,6 @@ class Muser extends CI_Model {
 	{
 		$username = $this->input->post("username");
 		$password = $this->input->post("password");
-		$apikey = $this->input->post("apikey");
-
-		if ($apikey !== false) {
-			if ($this->apilogin(trim($apikey))) {
-				return true;
-			}
-			show_error("API key login failed", 401);
-		}
 
 		// prefer post parameters if either (username or password) is set
 		if ($username === false && $password === false) {
@@ -84,19 +76,24 @@ class Muser extends CI_Model {
 			}
 		}
 
-		if ($apikey === false && $username !== false && $password !== false) {
+		if ($username !== false && $password !== false) {
 			if ($this->login($username, $password)) {
 				return true;
 			} else {
 				show_error("Login failed", 401);
 			}
 		}
+
+		return null;
 	}
 
 	function apilogin($apikey)
 	{
 		$this->require_session();
 
+		// get rid of spaces and newlines
+		$apikey = trim($apikey);
+
 		$query = $this->db->query("
 			SELECT a.user userid
 			FROM apikeys a
@@ -111,7 +108,7 @@ class Muser extends CI_Model {
 			return true;
 		}
 
-		return false;
+		show_error("API key login failed", 401);
 	}
 
 	function logout()
@@ -168,22 +165,26 @@ class Muser extends CI_Model {
 			return true;
 		}
 
-		show_error("Access denied", 403);
+		show_error("Access denied: Access level too low", 403);
 	}
 
 	function require_access($wanted_level = "full")
 	{
+		if ($this->input->post("apikey") !== false) {
+			$this->apilogin($this->input->post("apikey"));
+		}
+
+		if (is_cli_client()) {
+			$this->login_cli_client();
+		}
+
 		if ($this->logged_in()) {
 			return $this->check_access_level($wanted_level);
 		}
 
+		// if a CLI client reaches this point it failed to log in
 		if (is_cli_client()) {
-			if ($this->login_cli_client()) {
-				return $this->check_access_level($wanted_level);
-			}
-
-			echo "FileBin requires you to have an account, please go to the homepage for more information.\n";
-			exit();
+			show_error("Not authenticated. FileBin requires you to have an account, please go to the homepage for more information.\n", 401);
 		}
 
 		// desktop clients get redirected to the login form
-- 
cgit v1.2.3-24-g4f1b