Delete and Download 'Buttons' do not include &action or &token and fail.

[tigzy]

Delete and Download 'Buttons' do not include &action or &token and fail.

[Tigzy]

Hello,
Because the DELETE is supposed to have an action as well, like you said "action=deletefile"
This is indeed badly documented, and will be added.
To know the action needed look into api.php for method names.

[Tigzy]

Or maybe I misunderstood, you talked about button .
Sounds like a bug, I'll look at this.

[vimgodfrey]

This should better explain; The buttons are making calls to the same API are they not? Thanks.

[Tigzy]

Yeah, that's right there's a bug here. I'll check what's wrong.

[Tigzy]

Ok, problem is here:
https://github.com/Tigzy/malware-repo/blob/master/api.php#L15

Should be replaced by:

// Extract requested API
$func = isset($_REQUEST['action']) ? strtolower(trim(str_replace("/","",$_REQUEST['action']))) : null;  
if (!$func && isset($_POST['action'])) $func = strtolower(trim(str_replace("/","",$_POST['action']))) ; 

// Could not extract function, and is not a DELETE request
if (!$func && $this->get_request_method() != "DELETE")  $this->response('',406);

[vimgodfrey]

Can confirm that fixed the Delete Button- Thanks!

Still having issues with the MD5 download link.
Current link is missing &action=getfiles and returns 406
Including &action=getfiles in POST returns file (200)

[Tigzy]

True, I'm looking.

[Tigzy]

The bug is linked to the previous, those are special url not using the API model and thus that need to be removed from the action check. Please replace the same code with this updated one:

// Extract requested API
$func = isset($_REQUEST['action']) ? strtolower(trim(str_replace("/","",$_REQUEST['action']))) : null;  
if (!$func && isset($_POST['action'])) $func = strtolower(trim(str_replace("/","",$_POST['action']))) ; 

// Could not extract function, and is not a DELETE request nor a DOWNLOAD request
if (!$func && $this->get_request_method() != "DELETE" && !(isset($_REQUEST) && isset($_REQUEST['download']))) {
    $this->response('',406);
}

[vimgodfrey]

Confirmed fix, thanks.

[Tigzy]

No problem, that will be added in next release.
Thanks for your bug report.