From 096c7ac1682e6ee3dcd091d7e089f64af4f836d0 Mon Sep 17 00:00:00 2001
From: Xiretza <xiretza@xiretza.xyz>
Date: Tue, 16 Aug 2022 21:16:22 +0200
Subject: [PATCH] server: clean up scripts, require POST for non-idempotent
 requests

---
 server/ping-get.php | 24 +++++++++++++++---------
 server/ping.php     | 23 +++++++++++++----------
 server/status.txt   |  0
 server/update.php   | 44 ++++++++++++++++++++++++--------------------
 4 files changed, 52 insertions(+), 39 deletions(-)
 mode change 100644 => 100755 server/ping-get.php
 mode change 100644 => 100755 server/ping.php
 mode change 100755 => 100644 server/status.txt

diff --git a/server/ping-get.php b/server/ping-get.php
old mode 100644
new mode 100755
index 5985715..4945496
--- a/server/ping-get.php
+++ b/server/ping-get.php
@@ -1,16 +1,22 @@
 <?php
-require_once('config.inc.php');
 
+require_once('config.inc.php');
 $apikeys = $config['ping-get'];
 
 header('Content-type: text/plain');
-if(isset($_GET['apikey']) && in_array($_GET['apikey'], $apikeys, true)) {
-    $str=file_get_contents('pinged.txt');
-    echo $str;
-    file_put_contents ( 'pinged.txt' , 'false' );
-} else {
-    $str=file_get_contents('pinged.txt');
-    echo "API Key Missing!\n";
-    echo $str;
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+	echo "Must use POST request method\n";
+	return;
 }
+
+if (!isset($_GET['apikey']) || !in_array($_GET['apikey'], $apikeys, true)) {
+	echo "Invalid API key\n";
+	return;
+}
+
+$str=file_get_contents('pinged.txt');
+echo $str;
+file_put_contents('pinged.txt', 'false');
+
 ?>
diff --git a/server/ping.php b/server/ping.php
old mode 100644
new mode 100755
index 42982e4..5642e9f
--- a/server/ping.php
+++ b/server/ping.php
@@ -1,17 +1,20 @@
 <?php
-require_once('config.inc.php');
 
+require_once('config.inc.php');
 $apikeys = $config['ping'];
 
 header('Content-type: text/plain');
-if ($_SERVER['REQUEST_METHOD'] == 'POST' &&
-    isset($_GET['apikey']) && in_array($_GET['apikey'], $apikeys, true))
-{
-    file_put_contents ( 'pinged.txt' , 'true' );
-    echo $str;
-} else {
-    $str=file_get_contents('pinged.txt');
-    echo "API Key Missing (must be POST method)!\n";
-    echo $str;
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+	echo "Must use POST request method\n";
+	return;
 }
+
+if (!isset($_GET['apikey']) || !in_array($_GET['apikey'], $apikeys, true)) {
+	echo "Invalid API key\n";
+	return;
+}
+
+file_put_contents('pinged.txt', 'true');
+
 ?>
diff --git a/server/status.txt b/server/status.txt
old mode 100755
new mode 100644
diff --git a/server/update.php b/server/update.php
index 8494869..0514dad 100755
--- a/server/update.php
+++ b/server/update.php
@@ -1,30 +1,34 @@
 <?php
 
 require_once('config.inc.php');
-
 $apikeys = $config['update'];
 
 header('Content-type: text/plain');
-if( isset($_GET['apikey']) && in_array($_GET['apikey'], $apikeys, true) ) {
-    if(isset($_GET['open']) && $_GET['open']=='true')
-    {
-        file_put_contents ( 'status.txt' , 'true,'.time() );
-        exec("./open.sh");
-        echo "true";
-    } else if(isset($_GET['open']) && $_GET['open'] =='false') {
-        file_put_contents ( 'status.txt' , 'false,'.time() );
-        exec("./close.sh");
-        echo "false";
-    }else{
-        echo "you are too stupid to use the api!\n";
-    }
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+	echo "Must use POST request method\n";
+	return;
+}
+
+if (!isset($_GET['apikey']) || !in_array($_GET['apikey'], $apikeys, true)) {
+	echo "Invalid API key\n";
+	return;
+}
+
+if (!isset($_GET['open'])) {
+	echo "Missing 'open' request parameter\n";
+	return;
+}
+
+if ($_GET['open'] === 'true') {
+	file_put_contents('status.txt', 'true,'.time());
+	echo "true";
+} else if ($_GET['open'] === 'false') {
+	file_put_contents('status.txt', 'false,'.time());
+	echo "false";
 } else {
-    $str=file_get_contents('status.txt');
-    $arr=explode(',',$str);
-    $open=$arr[0];
-    $date=$arr[1]; //lastchange: upadate via file see explode/implode
-    echo "API Key Missing!\n";
-    echo $open;
+	echo "Invalid 'open' parameter value\n";
+	return;
 }
 
 ?>