From b54a6d3e68c97c73af4d5e1a6288e8b257cbd517 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Thu, 29 Jun 2017 13:04:54 +0300
Subject: don't start sessions needlessly

---
 backend.php | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

(limited to 'backend.php')

diff --git a/backend.php b/backend.php
index 018c0e8..7cd15bb 100644
--- a/backend.php
+++ b/backend.php
@@ -1,11 +1,20 @@
 <?php
 
 	require_once "config.php";
-	require_once "sessions.php";
-	require_once "db.php";
 
 	header("Content-type: text/json");
 
+	// let's not start a session if there's no cookie, login is impossible
+	// via backend anyway
+	if (!isset($_COOKIE['epube_sid'])) {
+		header($_SERVER["SERVER_PROTOCOL"]." 402 Unauthorized");
+		echo "Unauthorized";
+		die;
+	}
+
+	require_once "sessions.php";
+	require_once "db.php";
+
 	@$owner = SQLite3::escapeString($_SESSION["owner"]);
 
 	if (!$owner) {
-- 
cgit v1.2.3