<commit_before><?php

/**
 * A JSON REST API for ZenPhoto.  Supports building mobile apps,
 * javascript-heavy web apps, and other types of integrations.
 *
 * This filter will detect a query string parameter (?api) and
 * return a JSON representation of the album or search results
 * instead of the normal HTML response.
 *
 * @author <NAME> (deanmoses)
 * @package plugins
 * @subpackage development
 */
$plugin_is_filter = 900 | FEATURE_PLUGIN;
$plugin_description = gettext('REST API for Zenphoto');
$plugin_author = "<NAME> (deanmoses)";
$plugin_version = '0.9.0';

// Handle API calls before anything else
if (!OFFSET_PATH && isset($_GET['api'])) {
	zp_register_filter('load_theme_script', 'executeRestApi', 9999);
}

function executeRestApi() {
	global $_zp_gallery, $_zp_current_album, $_zp_current_image, $_zp_albums,$_zp_current_search,$_zp_current_context,$_zp_current_admin_obj;
	header('Content-type: application/json; charset=UTF-8');

	// If the request is coming from a subdomain, send the CORS headers
	// that allow cross domain AJAX.  This is important when the web 
	// front end is being served from sub.domain.com, but its AJAX
	// requests are hitting this zenphoto installation on domain.com

	// Browsers send the Origin header only when making an AJAX request
	// to a different domain than the page was served from.  It's the 
	// protocol://hostname that the web app was served from.  In most 
	// cases it'll be a subdomain like http://cdn.zenphoto.com
    if (isset($_SERVER['HTTP_ORIGIN'])) {
    	// The Host header is the hostname the browser thinks it's 
    	// sending the AJAX request to. In most casts it'll be the root 
    	// domain like zenphoto.com

    	// If the Host is a substring within Origin, Origin is most likely a subdomain
    	// Todo: implement a proper 'endsWith'
        if (strpos($_SERVER['HTTP_ORIGIN'], $_SERVER['HTTP_HOST']) !== false) {
        	// Allow CORS requests from the subdomain the ajax request is coming from
        	header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");

        	// Add a Vary header so that CDNs know they need to cache different
        	// copies of the response when browsers send different Origin headers.  
        	// This allows us to have clients on foo.zenphoto.com and bar.zenphoto.com, 
        	// and the CDN will cache different copies of the response for each of them, 
        	// with the appropriate Access-Control-Allow-Origin header set.
        	header('Vary: Origin', false /* Allow for multiple Vary headers, other things could be adding a Vary as well. */);

        	// Allow credentials to be sent in CORS requests.  Really only needed on auth requests
        	header('Access-Control-Allow-Credentials: true');
        }
    }

	$_zp_gallery_page = 'rest_api.php';

	// the data structure we will be returning via JSON
	$ret = array();
	
	// If this is a request to see if the user is an admin, return that info
	if (isset($_GET['auth'])) {
		// Make sure that authentication requests are never cached
		header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");

		$ret['isAdmin'] = isset($_zp_current_admin_obj) && (bool) $_zp_current_admin_obj;
	}
	// If there's a search, return it instead of albums
	else if ($_zp_current_search) {
		$ret['thumb_size'] = (int) getOption('thumb_size');
		
		$_zp_current_search->setSortType('date');<commit_msg>Always send Vary: Origin header<commit_after><?php

/**
 * A JSON REST API for ZenPhoto.  Supports building mobile apps,
 * javascript-heavy web apps, and other types of integrations.
 *
 * This filter will detect a query string parameter (?api) and
 * return a JSON representation of the album or search results
 * instead of the normal HTML response.
 *
 * @author <NAME> (deanmoses)
 * @package plugins
 * @subpackage development
 */
$plugin_is_filter = 900 | FEATURE_PLUGIN;
$plugin_description = gettext('REST API for Zenphoto');
$plugin_author = "<NAME> (deanmoses)";
$plugin_version = '0.9.0';

// Handle API calls before anything else
if (!OFFSET_PATH && isset($_GET['api'])) {
	zp_register_filter('load_theme_script', 'executeRestApi', 9999);
}

function executeRestApi() {
	global $_zp_gallery, $_zp_current_album, $_zp_current_image, $_zp_albums,$_zp_current_search,$_zp_current_context,$_zp_current_admin_obj;
	header('Content-type: application/json; charset=UTF-8');

	// If the request is coming from a subdomain, send the CORS headers
	// that allow cross domain AJAX.  This is important when the web 
	// front end is being served from sub.domain.com, but its AJAX
	// requests are hitting this zenphoto installation on domain.com

	// Browsers send the Origin header only when making an AJAX request
	// to a different domain than the page was served from.  It's the 
	// protocol://hostname that the web app was served from.  In most 
	// cases it'll be a subdomain like http://cdn.zenphoto.com
    if (isset($_SERVER['HTTP_ORIGIN'])) {
    	// The Host header is the hostname the browser thinks it's 
    	// sending the AJAX request to. In most casts it'll be the root 
    	// domain like zenphoto.com

    	// If the Host is a substring within Origin, Origin is most likely a subdomain
    	// Todo: implement a proper 'endsWith'
        if (strpos($_SERVER['HTTP_ORIGIN'], $_SERVER['HTTP_HOST']) !== false) {
        	// Allow CORS requests from the subdomain the ajax request is coming from
        	header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");

        	// Allow credentials to be sent in CORS requests.  Really only needed on auth requests
        	header('Access-Control-Allow-Credentials: true');
        }
    }

    // Add a Vary header so that browsers and CDNs know they need to cache different
	// copies of the response when browsers send different Origin headers.  
	// This allows us to have clients on foo.zenphoto.com and bar.zenphoto.com, 
	// and the CDN will cache different copies of the response for each of them, 
	// with the appropriate Access-Control-Allow-Origin header set.
	header('Vary: Origin', false /* Allow for multiple Vary headers, other things could be adding a Vary as well. */);

	$_zp_gallery_page = 'rest_api.php';

	// the data structure we will be returning via JSON
	$ret = array();
	
	// If this is a request to see if the user is an admin, return that info
	if (isset($_GET['auth'])) {
		// Make sure that authentication requests are never cached
		header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");

		$ret['isAdmin'] = isset($_zp_current_admin_obj) && (bool) $_zp_current_admin_obj;
	}
	// If there's a search, return it instead of albums
	else if ($_zp_current_search) {
		$ret['thumb_size'] = (int) getOption('thumb_size');
		
		$_zp_current_search->setSortType('date');
{'fraction_non_alphanumeric': 0.1036567384252433, 'fraction_numerical': 0.003538779121203185, 'mean_word_length': 3.6268758526603, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1077898', 'n_tokens_mistral': 2079, 'n_tokens_neox': 1982, 'n_words': 769}