From a8bbdf907a10e4ce0dd9cb1017fc749df6d12138 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Gr=C3=B6ber?= <dxld@darkboxed.org>
Date: Sun, 27 Mar 2022 18:19:58 +0200
Subject: [PATCH] Mandate POST method for ping.php

---
 server/ping.php | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/server/ping.php b/server/ping.php
index 56bc660..42982e4 100644
--- a/server/ping.php
+++ b/server/ping.php
@@ -1,12 +1,17 @@
 <?php
-	header('Content-type: text/plain');
-	if(isset($_GET['apikey']) && ($_GET['apikey']=='apikey1' || $_GET['apikey']=='apikey2')){
-     		file_put_contents ( 'pinged.txt' , 'true' );
-		echo true;
-        }else{
-		$str=file_get_contents('pinged.txt');
-		echo "API Key Missing!\n";
-        	echo $str;
-	}
-?>
+require_once('config.inc.php');
 
+$apikeys = $config['ping'];
+
+header('Content-type: text/plain');
+if ($_SERVER['REQUEST_METHOD'] == 'POST' &&
+    isset($_GET['apikey']) && in_array($_GET['apikey'], $apikeys, true))
+{
+    file_put_contents ( 'pinged.txt' , 'true' );
+    echo $str;
+} else {
+    $str=file_get_contents('pinged.txt');
+    echo "API Key Missing (must be POST method)!\n";
+    echo $str;
+}
+?>