added api url

.htaccess

@@ -15,6 +15,39 @@
   RewriteRule ^edit-recipe/([0-9]+)$ ?site=edit-recipe&number=$1
 
   #Loginseite
-  RewriteRule ^login/url=(.+)$ ?site=login&refurl=$1 [L]
+  RewriteRule ^login/url=(.+)$ ?site=login&refurl=$1
 
+  #API Calls
+  RewriteRule ^api/([\w-]+)/([\w-]+)$ php/api.php?site=api&call=$1&function=$2 [L]
 </IfModule>
+
+<Files *.php>
+    Order Deny,Allow
+    Deny from all
+    Allow from 127.0.0.1
+</Files>
+
+<Files index.php>
+    Order Allow,Deny
+    Allow from all
+</Files>
+
+<Files api.php>
+    Order Allow,Deny
+    Allow from all
+</Files>
+
+<Files login.php>
+    Order Allow,Deny
+    Allow from all
+</Files>
+
+<Files logout.php>
+    Order Allow,Deny
+    Allow from all
+</Files>
+
+<Files install*.php>
+    Order Allow,Deny
+    Allow from all
+</Files>

bin/autocomplete.js

@@ -71,10 +71,8 @@ var values = [];
 $(document).ready(function(){
   $.ajax({
     type: "POST",
-    url: "/php/edit-recipes.php",
-    data: {
-      function: "auto",
-    },
+    url: "/api/recipes/auto",
+    data: {},
     success: function(data){
       values = data.split("||");
     }

bin/edit-recipe.js

@@ -1,16 +1,15 @@
 $(document).ready(function(){
   var recipeID = window.location.href.split("/")[(window.location.href.split("/").length-1)];
-  $("#FormSubmitfunction").prop("value", "update");
+  $("#newRecipeForm").prop("action", "/api/recipes/update");
   $.ajax({
     type: "POST",
-    url: "/php/edit-recipes.php",
+    url: "/api/recipes/edit",
     data: {
-      function: "edit",
       id: recipeID
     },
     success: function(data){
       var recipe = JSON.parse(data);
-      $("#FormSubmitfunction").after("<input type='hidden' name='id' value='"+recipe.ID+"'>");
+      $("#safeRecipe").before("<input type='hidden' name='id' value='"+recipe.ID+"'>");
       $("#RecipeFormName").val(recipe.Name);
       $("#recipeDurationInput").val(recipe.Dauer);
       $("#recipeDescription").val(recipe.Beschreibung);

bin/list.js

@@ -3,9 +3,8 @@ $(document).ready(function(){
     var dataId = $(this).parent().data("id");
     $.ajax({
       type: "POST",
-      url: "php/edit-list.php",
+      url: "api/list/check",
       data: {
-        function: "check",
         id: dataId,
         status: $(this).prop("checked")
       },
@@ -18,10 +17,7 @@ $(document).ready(function(){
   $("#remove").click(function(){
     $.ajax({
       type: "POST",
-      url: "php/edit-list.php",
-      data: {
-        function: "del"
-      },
+      url: "api/list/del",
       success: function(){
         location.reload();
       }

bin/manageRecipe.js

@@ -14,9 +14,8 @@ $(document).ready(function(){
     if(!(confirm("Wirklich löschen?"))){return;}
     $.ajax({
       type: "POST",
-      url: "/php/edit-recipes.php",
+      url: "/api/recipes/del",
       data: {
-        function: "del",
         id: $("#recipeHeader").data("recipeid")
       },
       success: function(data){

bin/recipe.js

@@ -14,9 +14,8 @@ $(document).ready(function(){
     if(!(confirm("Wirklich löschen?"))){return;}
     $.ajax({
       type: "POST",
-      url: "/php/edit-recipes.php",
+      url: "/api/recipes/del",
       data: {
-        function: "del",
         id: $("#recipeHeader").data("recipeid")
       },
       success: function(data){
@@ -45,10 +44,9 @@ $(document).ready(function(){
     });
     $.ajax({
       type: "POST",
-      url: "/php/edit-list.php",
+      url: "/api/list/multiple",
       data: {
-        list: list,
-        function: "multiple"
+        list: list
       },
       success: function(data){
         window.location = "/";

bin/settings.js

@@ -52,13 +52,13 @@ $(document).ready(function(){
   });
 
   $("#export-recipe-button").click(function(){
-    $.post("/php/edit-recipes.php", {function:"export"}, function(data){
+    $.post("/api/recipes/export", {}, function(data){
       downloadObjectAsJson(JSON.parse(data), "recipes");
     });
   });
 
   $("#export-list-button").click(function(){
-    $.post("/php/edit-list.php", {function:"export"}, function(data){
+    $.post("/api/list/export", {}, function(data){
       downloadObjectAsJson(JSON.parse(data), "list");
     });
   });
@@ -70,9 +70,8 @@ $(document).ready(function(){
       reader.onload = function(){
         var content = JSON.parse(reader.result);
         if(content.sites!=null){
-          $.post("/php/edit-recipes.php",
+          $.post("/api/recipes/import",
             {
-              function: "import",
               content: reader.result
             },
             function(data){
@@ -87,9 +86,8 @@ $(document).ready(function(){
           );
         }
         else if(content.list!=null){
-          $.post("/php/edit-list.php",
+          $.post("/api/list/import",
             {
-              function: "import",
               content: reader.result
             },
             function(data){

config/.htaccess

@@ -1,4 +0,0 @@
-# prevent access to these files while not logged in
-<files "*.php">
-  Require all denied
-</files>

cont/.htaccess

@@ -1,4 +0,0 @@
-# prevent access to these files while not logged in
-<files "*.php">
-  Require all denied
-</files>

cont/list.php

@@ -2,7 +2,7 @@
 <link rel="stylesheet" href="/style/list.css">
 <h1>Liste</h1>
 <button type="button" id="remove" class="button">Auswahl entfernen</button>
-<form id="neu" action="php/edit-list.php" method="post">
+<form id="neu" action="api/list/new" method="post">
   <input type="hidden" name="function" value="new">
 <div id="list">
   <?php

cont/manageRecipe.php

@@ -8,8 +8,7 @@
 else{
   echo "<h1 id=\"header\">Neu</h1>";
 } ?>
-<form id="newRecipeForm" autocomplete="off" action="/php/edit-recipes.php" method="post">
-  <input id="FormSubmitfunction" type="hidden" name="function" value="new">
+<form id="newRecipeForm" autocomplete="off" action="/api/recipes/new" method="post">
   <div><input id="safeRecipe" type="submit" name="" value="Speichern" class="button"> </div>
   <div><font>Name:</font><br /><input id="RecipeFormName" type="text" name="recipeName" placeholder="Name" required="required"></div>
   <div><font>Dauer (Minuten):</font><br /><input type="number" name="recipeDuration" id="recipeDurationInput" value="30"></div>

install/install_action.php

@@ -209,5 +209,5 @@ foreach($SQLStatements as $statement){
   $result = $connection->query($statement);
 }
 $connection->close();
-header ("Location: adduser.php");
+header ("Location: install_adduser.php");
 ?>

php/.htaccess

@@ -1,16 +0,0 @@
-# prevent access to these files while not logged in
-<files "classes.*.php">
-  Require all denied
-</files>
-
-<files "auth.php">
-  Require all denied
-</files>
-
-<files "connect.php">
-  Require all denied
-</files>
-
-<files "hash.php">
-  Require all denied
-</files>

php/api.php

@@ -0,0 +1,20 @@
+<?php
+  session_start();
+  switch($_GET["call"]) {
+    case 'list':
+      include $_SESSION["docroot"].'/php/edit-list.php';
+      break;
+
+    case 'recipes':
+      include $_SESSION["docroot"].'/php/edit-recipes.php';
+      break;
+
+    case 'user':
+      include $_SESSION["docroot"].'/php/edit-user.php';
+      break;
+
+    default:
+      echo "API call not defined";
+      break;
+  }
+?>

php/edit-list.php

@@ -1,9 +1,8 @@
 <?php
-  session_start();
   include $_SESSION["docroot"].'/php/classes.list.php';
   $shopping = new shopping;
 
-  switch ($_POST["function"]) {
+  switch ($_GET["function"]) {
     case 'new':
       $shopping->newItem($_POST["anzahl"], $_POST["einheit"], $_POST["name"]);
       header("Location: /list");

php/edit-recipes.php

@@ -1,9 +1,8 @@
 <?php
-  session_start();
   include $_SESSION["docroot"].'/php/classes.recipe.php';
   $book = new cookbook;
 
-  switch ($_POST["function"]) {
+  switch ($_GET["function"]) {
     case 'del':
       $book->removeRecipe($_POST["id"]);
       break;

php/edit-user.php

@@ -1,12 +1,11 @@
 <?php
-  session_start();
   include $_SESSION["docroot"].'/php/classes.user.php';
   $user = new user;
   if($_POST["function"]!="new-user"){
     $user->get_info($_COOKIE["token"]);
   }
 
-  switch ($_POST["function"]) {
+  switch ($_GET["function"]) {
     case 'change-pw':
       $user->change_password($_POST["current"], $_POST["new"]);
       break;