Hello Mike.<br>
<br>
Thanks for the ansewer.<br>
<br>
I'm doing some search to evaluate how hard is to implement a session mechanism in SOAP services in PHP.<br>
<br>
I'll post my results.<br>
<br>
In mean time, if someone has suggestions, please do post them.<br>
<br>
And about my sugestion regarding $_SERVER[], forget it. I thought that
it was possible to define there some custom server global variables,
but it isn't.<br>
<br>
Best Regards<br>
Joćo Oliveira<br><br><div><span class="gmail_quote">On 3/22/06, <b class="gmail_sendername">Mike Fedyk</b> <<a href="mailto:mfedyk@mikefedyk.com">mfedyk@mikefedyk.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
How hard is it to do the authentication code? If it can't be done<br>quickly then let's create a variable that turns soap off when (so<br>upgrades will disable soap even if the new variable is not in config.php).<br><br>
Joao Oliveira wrote:<br>> Hello all,<br>><br>> I've been looking at vtiger SOAP (version 4.2.x and 5 alpha), and i've<br>> realized that there is an authentication mechanism for them, but it<br>> only returns true or false...
<br>><br>> Once that you guys have been doing a great effort in order to improve<br>> security, but i think that all security is possible to bypass by<br>> accessing by SOAP Services. Am I wrong ?<br>><br>> for example...
<br>><br>> method DeleteTasks($username,$crmid) in vtigerolservice.php<br>><br>> If i'm a stranger, i still can do something like DeleteTasks('admin',<br>> 1); without any kind of authentication ...<br>>
<br>> IMHO, it should be used any kind of token authentication and saved in<br>> $_SERVER[] variable, or authenticate an user with username/password<br>> each time one method is call.<br>><br>> Best Regards
<br>> Joćo Oliveira.<br>> ------------------------------------------------------------------------<br>><br>> _______________________________________________<br>>
This <a href="http://vtiger.com">vtiger.com</a> email is sponsored by Zoho Planner. Still scribbling
down your To-Do's on bits of paper & palms of your hands? Try the
AJAX enabled, personal organizer online, Zoho Planner for FREE instead!
<a href="http://zohoplanner.com/?vt">http://zohoplanner.com/?vt</a><br>_______________________________________________<br>This
<a href="http://vtiger.com">vtiger.com</a> email is sponsored by Zoho Planner. Still scribbling down
your To-Do's on bits of paper & palms of your hands? Try the AJAX
enabled, personal organizer online, Zoho Planner for FREE instead!
<a href="http://zohoplanner.com/?vt">http://zohoplanner.com/?vt</a><br></blockquote></div><br>