if ( isset($_POST['AUTH']) ) {
// verify the authentication, re-request if necessary - we expire an AUTH key from time to time
// if the key is idle for too long, or if it's used from a different IP address
$authQ = $blufDB->query(sprintf("SELECT memberid, lastIP, UNIX_TIMESTAMP(lastAuth) AS lastAuth, appid FROM apiAuth WHERE hash = '%s'",$blufDB->real_escape_string($_POST['AUTH']))) ;
if ( $authQ->num_rows != 1 ) {
// the user has been logged out
send_api_response('reauth','','Session expired or invalid','') ;
// api_error('Authorisation error') ;
exit ;
} else {
$auth = $authQ->fetch_assoc() ;
if ( $_SERVER['REMOTE_ADDR'] != $auth['lastIP'] ) {
// IP address changed, demand a reauth
send_api_response('reauth','','IP changed address change detected','') ;
exit ;
} elseif ( $auth['lastAuth'] < (time() - ( 60 * $expiryTime )) ) {
// no request within expiry limit
send_api_response('reauth','','Auth timeout exceeded','') ;
exit ;
} else {
// update the lastAuth timestamp
$blufDB->query(sprintf("UPDATE apiAuth SET lastAuth = NOW() WHERE hash = '%s'",$blufDB->real_escape_string($_POST['AUTH']))) ;
}
}
}