From 892660d5d1b2d8c636e742b6daaf22fff6971265 Mon Sep 17 00:00:00 2001
From: Terranom674 <thomas_dannenberg@web.de>
Date: Mon, 17 Aug 2026 13:45:10 +0200
Subject: [PATCH] Split Piwigo API key diagnostic credentials

---
 include/nc_connector_piwigo_api.inc.php | 36 +++++++++++++++++--------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/include/nc_connector_piwigo_api.inc.php b/include/nc_connector_piwigo_api.inc.php
index 4a9f52f..a2ace79 100644
--- a/include/nc_connector_piwigo_api.inc.php
+++ b/include/nc_connector_piwigo_api.inc.php
@@ -4,13 +4,23 @@ if (!defined('PHPWG_ROOT_PATH'))
   die('Hacking attempt!');
 }
 
-function bratonien_tools_nc_connector_piwigo_api_request($api_key, $method)
+function bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_secret, $method)
 {
   if (!function_exists('curl_init'))
   {
     throw new RuntimeException('cURL ist in PHP nicht verfuegbar. Der API-Key-Test kann nicht ausgefuehrt werden.');
   }
 
+  $api_key_id = trim((string)$api_key_id);
+  $api_key_secret = trim((string)$api_key_secret);
+  if ($api_key_id === '' || $api_key_secret === '')
+  {
+    throw new RuntimeException('API-Schluessel-ID und Geheimnis muessen angegeben werden.');
+  }
+
+  // Piwigo expects the exact header value "public-id:secret". The separator is
+  // added here by the connector and is not submitted through a form field.
+  $api_key = $api_key_id.':'.$api_key_secret;
   $url = rtrim(get_absolute_root_url(true), '/').'/ws.php';
   $ch = curl_init($url);
   curl_setopt_array($ch, array(
@@ -21,7 +31,7 @@ function bratonien_tools_nc_connector_piwigo_api_request($api_key, $method)
       'format' => 'json',
     )),
     CURLOPT_HTTPHEADER => array(
-      'X-PIWIGO-API: '.(string)$api_key,
+      'X-PIWIGO-API: '.$api_key,
       'Accept: application/json',
       'Content-Type: application/x-www-form-urlencoded',
     ),
@@ -35,6 +45,7 @@ function bratonien_tools_nc_connector_piwigo_api_request($api_key, $method)
   $errno = curl_errno($ch);
   $error = curl_error($ch);
   $http_code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  $content_type = (string)curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
   curl_close($ch);
 
   if ($body === false || $errno !== 0)
@@ -49,7 +60,8 @@ function bratonien_tools_nc_connector_piwigo_api_request($api_key, $method)
   $decoded = json_decode((string)$body, true);
   if (!is_array($decoded))
   {
-    throw new RuntimeException('Piwigo-API lieferte keine gueltige JSON-Antwort.');
+    $detail = $content_type !== '' ? ' Antworttyp: '.$content_type.'.' : '';
+    throw new RuntimeException('Piwigo-API lieferte keine gueltige JSON-Antwort.'.$detail);
   }
   if (($decoded['stat'] ?? '') !== 'ok')
   {
@@ -62,16 +74,18 @@ function bratonien_tools_nc_connector_piwigo_api_request($api_key, $method)
 
 function bratonien_tools_nc_connector_piwigo_api_test()
 {
-  $api_key = trim((string)($_POST['nc_piwigo_api_key'] ?? ''));
-  if ($api_key === '')
+  $api_key_id = trim((string)($_POST['nc_piwigo_api_key_id'] ?? ''));
+  $api_key_secret = trim((string)($_POST['nc_piwigo_api_key_secret'] ?? ''));
+  if ($api_key_id === '')
   {
-    throw new RuntimeException('Piwigo-API-Key fehlt.');
+    throw new RuntimeException('Piwigo-API-Schluessel-ID fehlt.');
+  }
+  if ($api_key_secret === '')
+  {
+    throw new RuntimeException('Piwigo-API-Geheimnis fehlt.');
   }
 
-  // Piwigo 16 API keys have a public pkid and a secret separated by a colon.
-  // Do not reject other formats outright so the checker remains useful if
-  // Piwigo changes the exact key syntax later.
-  $status = bratonien_tools_nc_connector_piwigo_api_request($api_key, 'pwg.session.getStatus');
+  $status = bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_secret, 'pwg.session.getStatus');
   if (!is_array($status))
   {
     throw new RuntimeException('Piwigo hat keinen auswertbaren Benutzerstatus geliefert.');
@@ -81,7 +95,7 @@ function bratonien_tools_nc_connector_piwigo_api_test()
   $user_status = strtolower((string)($status['status'] ?? ''));
   $is_admin = in_array($user_status, array('admin', 'webmaster'), true);
 
-  $method_result = bratonien_tools_nc_connector_piwigo_api_request($api_key, 'reflection.getMethodList');
+  $method_result = bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_secret, 'reflection.getMethodList');
   $methods = array();
   if (is_array($method_result))
   {