From eaf1f2fba3645ea4dcb0bf465704e14e1b9c8295 Mon Sep 17 00:00:00 2001
From: Nikolai R Kristiansen <nikolaik@gmail.com>
Date: Thu, 6 Aug 2015 20:43:23 +0200
Subject: [PATCH] Fixes membership renewal

---
 api/card.php       |  2 +-
 api/membership.php | 13 ++++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/api/card.php b/api/card.php
index f19df61..ddd6dcc 100644
--- a/api/card.php
+++ b/api/card.php
@@ -63,7 +63,7 @@ if($_SERVER['REQUEST_METHOD'] === 'POST') {
         return_json_response(array('user'=> NULL, 'card' => get_card($card_number)));
 
     }
-    else if($data['action'] === 'update_card') {
+    else if( in_array($data['action'], array('update_card', 'add_or_renew')) ) {
         /* Existing user */
         if( !is_numeric($data['user_id']) ) {
             return_json_response(array('error' => "Value user_id must be numeric: '".$data['user_id']."'"), 400);
diff --git a/api/membership.php b/api/membership.php
index 0ac6803..a4676da 100644
--- a/api/membership.php
+++ b/api/membership.php
@@ -44,11 +44,18 @@ foreach($data as $key => $value) {
 if( $data['apikey'] !== USER_API_KEY_KASSA ) {
     return_json_response(array('error' => "Invalid apikey: '".$data['apikey']."'."), 400);
 }
+/* Validate User id */
+if(strlen($data['user_id']) == 0) {
+    return_json_response(array('error' => "Param user_id can not be empty: '".var_export($data['user_id'], true)."'."), 400);
+}
+if( !is_numeric($data['user_id']) ) {
+    return_json_response(array('error' => "Param user_id must be a number: '".$data['user_id']."'."), 400);
+}
 
 $conn = get_db_connection(DB_FETCHMODE_ASSOC);
 
 /* Existing user? */
-$user = get_user($user_id);
+$user = get_user($data['user_id']);
 /* Don't allow renewal if valid membership exists. */
 if( $user['membership_status'] !== 0 ) {
     if($user['expires'] === '') {
@@ -75,7 +82,7 @@ if( isset($data['source']) && !in_array($data['source'], $valid_sources) ) {
 
 /* Add or renew membership */
 try {
-    add_or_renew_membership($user_id, $purchased);
+    add_or_renew_membership($data['user_id'], $purchased);
 } catch(InsideDatabaseException $e) {
     error_log($e->getMessage());
     return_json_response(array('error' => 'db_error', 'error_message' => $e->getMessage()), 500);
@@ -84,7 +91,7 @@ try {
 /* Get and format user */
 $user = NULL;
 try {
-    $user = get_user($user_id);
+    $user = get_user($data['user_id']);
 } catch(InsideDatabaseException $e) {
     error_log($e->getMessage());
     return_json_response(array('error' => 'db_error', 'error_message' => $e->getMessage()), 500);