don't start sessions needlessly

1 files changed, 11 insertions, 2 deletions

diff --git a/backend.php b/backend.php
index 018c0e8..7cd15bb 100644
--- a/backend.php
+++ b/backend.php
@@ -1,11 +1,20 @@
 <?php
 
 	require_once "config.php";
-	require_once "sessions.php";
-	require_once "db.php";
 
 	header("Content-type: text/json");
 
+	// let's not start a session if there's no cookie, login is impossible
+	// via backend anyway
+	if (!isset($_COOKIE['epube_sid'])) {
+		header($_SERVER["SERVER_PROTOCOL"]." 402 Unauthorized");
+		echo "Unauthorized";
+		die;
+	}
+
+	require_once "sessions.php";
+	require_once "db.php";
+
 	@$owner = SQLite3::escapeString($_SESSION["owner"]);
 
 	if (!$owner) {