Conheça as melhorias da versão 8.0, 8.1, 8.2!
Clique aqui para saber mais
webservice retornando todos os registro do banco Bom dia a toda comunidade, preparei um webservice pra retornar dados de um determinado registro da tabela Atendimento, para isso deve-se passar o protocolo de atendimento. Segue a chamada no WS: http://localhost/isonomicus_1.2/14476001000111/pagamento/191-TKI3-854/informarPagamento?prefeitura_cnpj=92923578000100&chave_acesso=202cb962ac59075b964b07152d234b70 O protocolo co...
RC
webservice retornando todos os registro do banco  
Bom dia a toda comunidade,
preparei um webservice pra retornar dados de um determinado registro da tabela Atendimento,
para isso deve-se passar o protocolo de atendimento.

Segue a chamada no WS:
http://localhost/isonomicus_1.2/14476001000111/pagamento/191-TKI3-854/informarPagamento?prefeitura_cnpj=92923578000100&chave_acesso=202cb962ac59075b964b07152d234b70


O protocolo consultado que está na string é o 191-TKI3-854
Esse é o protocolo exatamente igual ao que está registrado no banco e manda o retorno:
{ "status": "success", "data": "{ "atendimento_id":702, "system_user_id":"2", "registrado":"2019-08-13 11:43:25" }" }


Entretanto, se eu coloco um ponto em qualquer lugar do protocolo 19.1-TKI3-854 (tentativa de burlar o sistema), retorna-se todos os registros do banco, como pode se ver a seguir:

//query de WS http://localhost/isonomicus_1.2/14476001000111/pagamento/19.1-TKI3-854/informarPagamento?prefeitura_cnpj=92923578000100&chave_acesso=202cb962ac59075b964b07152d234b70 //retorno do WS { "status": "success", "data": [ { "id": 1, "atendimento_id": 272, "forma_pagamento_id": 3, "system_user_id": 2, "registrado": "2018-08-21 13:38:02", "valor_operacao": "470.43", "hash": "UEN25TMI1LIq713ZYV6500br", "email_enviado": null, "valor_parcela": "497.15", "qtd_parcelas": 2, "percentual_juros": "1.14" }, { "id": 2, "atendimento_id": 241, "forma_pagamento_id": 3, "system_user_id": 2, "registrado": "2019-01-03 18:07:01", "valor_operacao": "662.59", "hash": "YJW17AOT4YYx841SOW1333kf", "email_enviado": null, "valor_parcela": "324.49", "qtd_parcelas": 4, "percentual_juros": "7.8" }, { "id": 3, "atendimento_id": 387, "forma_pagamento_id": 3, "system_user_id": 2, "registrado": "2018-07-31 23:07:51", "valor_operacao": "420.66", "hash": "YZZ63CAE6PLw639SRK0062qq", "email_enviado": null, "valor_parcela": "108.95", "qtd_parcelas": 10, "percentual_juros": "0.59" }, { "id": 4, "atendimento_id": 697, "forma_pagamento_id": 3, "system_user_id": 2, "registrado": "2019-08-27 13:59:15", "valor_operacao": "573.46", "hash": "KWU08BLL2PLe818EDF8782rv", "email_enviado": null, "valor_parcela": "257.47", "qtd_parcelas": 7, "percentual_juros": "2.46" }, { "id": 5, "atendimento_id": 234, "forma_pagamento_id": 2, "system_user_id": 1, "registrado": "2019-11-07 02:01:55", "valor_operacao": "408.84", "hash": "XVO59PYN3RRh946LHZ3215qf", "email_enviado": null, "valor_parcela": "179.69", "qtd_parcelas": 2, "percentual_juros": "7.29" }, { "id": 6, "atendimento_id": 375, "forma_pagamento_id": 2, "system_user_id": 2, "registrado": "2018-09-13 23:11:54", "valor_operacao": "369.49", "hash": "FAT91LRV1EQw289TGV5671qw", "email_enviado": null, "valor_parcela": "252.62", "qtd_parcelas": 1, "percentual_juros": "5.7" }, { "id": 7, "atendimento_id": 583, "forma_pagamento_id": 1, "system_user_id": 1, "registrado": "2018-09-11 09:34:10", "valor_operacao": "495.84", "hash": "ARV91VGN2RQb732CCR2784vk", "email_enviado": null, "valor_parcela": "437.97", "qtd_parcelas": 6, "percentual_juros": "2.84" }, { "id": 8, "atendimento_id": 300, "forma_pagamento_id": 1, "system_user_id": 2, "registrado": "2019-05-25 02:23:58", "valor_operacao": "798.02", "hash": "SNN56NEU5UOj751KLR4106dt", "email_enviado": null, "valor_parcela": "339.5", "qtd_parcelas": 2, "percentual_juros": "5.09" }, { "id": 9, "atendimento_id": 551, "forma_pagamento_id": 3, "system_user_id": 1, "registrado": "2020-04-10 07:01:17", "valor_operacao": "624.84", "hash": "QOX16JAE0IHu263NDD4806gp", "email_enviado": null, "valor_parcela": "482.84", "qtd_parcelas": 3, "percentual_juros": "0.45" }, { "id": 10, "atendimento_id": 692, "forma_pagamento_id": 3, "system_user_id": 1, "registrado": "2020-02-19 05:26:46", "valor_operacao": "410.77", "hash": "AHP09TKN4QIg255UWE7234qo", "email_enviado": null, "valor_parcela": "330.27", "qtd_parcelas": 8, "percentual_juros": "8.92" }, { "id": 11, "atendimento_id": 555, "forma_pagamento_id": 3, "system_user_id": 2, "registrado": "2019-05-05 02:15:48", "valor_operacao": "832.33", "hash": "FMV72YLN1OLt431GXJ9074jc", "email_enviado": null, "valor_parcela": "181.69", "qtd_parcelas": 9, "percentual_juros": "7.4" } }


Tal comportamento É TOTALMENTE INDESEJADO.

Segue o código do serviço WS que construi:

 
  1. <?php
  2. /**
  3. * PagamentoService REST service
  4. */
  5. class PagamentoService extends AdiantiRecordService
  6. {
  7. const DATABASE = 'sistema';
  8. const ACTIVE_RECORD = 'Pagamento';
  9. /**
  10. * informarPagamento($param)
  11. *
  12. * informa o pagamento realizado para o Atendimento anteriormente gerado,
  13. * isto só é possível se o Atendimento estiver EM ABERTO
  14. *
  15. * @param $param['id'] protocolo do Atendimento
  16. * @return TRUE or FALSE
  17. */
  18. public function informarPagamento($param)
  19. {
  20. TTransaction::open(self::DATABASE);
  21. //checa permissao do acesso ao webservice
  22. if( WebserviceLog::checarPermissao($param) )
  23. {
  24. //pega a prefeitura que se quer consultar os dados
  25. $pref = Prefeitura::loadByCNPJ($param['prefeitura_cnpj']);
  26. //pega o credenciado que esta consumindo o webservice
  27. $dados = explode('/', $_SERVER['REQUEST_URI']);
  28. $cred = Credenciado::loadByCNPJ($dados[2]);
  29. //grava o log do webservice
  30. WebserviceLog::registrar($pref->id, $cred->id);
  31. //checa o protocolo do Atendimento
  32. if( empty($param['id']) )
  33. {
  34. throw new Exception('Informe o protocolo do Atendimento');
  35. }
  36. //checa se existe Atendimento em aberto pelo protocolo informado
  37. $atend = Atendimento::where('protocolo', '=', $param['id'])
  38. ->where('atendimento_status_id', '=', AtendimentoStatus::ABERTO)
  39. ->load();
  40. //Notifica o atendimento (caso exista) para o Contribuinte de Credenciado diferente daquele do protocolo gerado
  41. if( isset($atend[0]) and ($atend[0]->credenciado_id != $cred->id))
  42. {
  43. //gera notificação para o administrador do sistema
  44. SystemNotification::register( 1, 'Pagamento realizado por Credenciado diferente',
  45. $cred->razao_social . ' informou Pagamento para o protocolo ' . $atend[0]->protocolo .
  46. ', mas este Atendimento está vinculado ao Credenciado ' . $atend[0]->credenciado->razao_social,
  47. 'class=AtendimentoFormView&method=onShow&key=' . $atend[0]->id,
  48. 'Consultar Atendimento', 'fa fa-search #478fca' );
  49. }
  50. //throw new Exception(print_r($atend));
  51. //salva o Pagamento
  52. $object = new Pagamento();
  53. $object->atendimento_id = $atend[0]->id;
  54. $object->system_user_id = SystemUsers::ISONOMICUS;
  55. $object->registrado = date('Y-m-d H:i:s');
  56. /*
  57. $object->forma_pagamento_id = ;
  58. $object->valor_operacao = ;
  59. $object->valor_parcela = ;
  60. $object->qtd_parcelas = ;
  61. $object->percentual_juros = ;
  62. $object-> = ;
  63. $object->gerarHash();
  64. $object->store(); // save the object
  65. */
  66. TTransaction::close();
  67. return $object->toJson();
  68. }
  69. }
  70. /**
  71. * delete($param)
  72. *
  73. * Delete an Active Records by its ID
  74. *
  75. * @return The Operation result
  76. * @param $param['id'] Object ID
  77. */
  78. public function delete($param)
  79. {
  80. throw new Exception('Função não permitida!');
  81. }
  82. /**
  83. * store($param)
  84. *
  85. * Save an Active Records
  86. *
  87. * @return The Operation result
  88. * @param $param['data'] Associative array with object data
  89. */
  90. public function store($param)
  91. {
  92. throw new Exception('Função não permitida!');
  93. }
  94. /**
  95. * loadall($param)
  96. *
  97. * List the Active Records by the filter
  98. *
  99. * @return Array of records
  100. * @param $param['offset'] Query offset
  101. * $param['limit'] Query limit
  102. * $param['order'] Query order by
  103. * $param['direction'] Query order direction (asc, desc)
  104. * $param['filters'] Query filters (array with field,operator,field)
  105. */
  106. public function loadall($param)
  107. {
  108. throw new Exception('Função não permitida!');
  109. }
  110. /**
  111. * deleteAll($param)
  112. *
  113. * Delete the Active Records by the filter
  114. *
  115. * @return Array of records
  116. * @param $param['filters'] Query filters (array with field,operator,field)
  117. */
  118. public function deleteAll($param)
  119. {
  120. throw new Exception('Função não permitida!');
  121. }
  122. }
  123. ?>

Curso Dominando o Adianti Framework

O material mais completo de treinamento do Framework.
Curso em vídeo aulas + Livro completo + Códigos fontes do projeto ERPHouse.
Conteúdo Atualizado!


Dominando o Adianti Framework Quero me inscrever agora!

Comentários (8)


RC

Se alguém conseguir identificar o problema avise, esta falha na segurança pode estar acontecendo em outros sistemas.
MG

Ricardo,
Para melhorar ainda mais a segurança use sempre POST no lugar de GET nas chamadas
Crie um token de segurança para checar quem está solicitando algum serviço, enviando ele pelo header.
Outro detalhe que faço em meus serviços, eu faço o tratamento do dado enviado, principalmente se for alguma chave. No seu caso, verifique a estrutura do Protocolo antes de continuar a execução do serviço.
Se o protocolo tem esta estrutura AAA-AAA-AAA, então antes de buscar, retire todos os outros caracteres que possa ser indesejados usando expressões regulares ou até mesmo um str_replace.
RC

Olá Marcelo Gomes,
eu tratei o parâmetro enviado com str_replace como havia sugerido.
Entretanto o erro continua.
Eu já utilizo token de segurança com jwt token.
Estou tentando tratar as requisições mesmo com GET para evitar que clientes mal intencionados tenham acesso indevido ao banco.

A requisição GET está assim:
http://localhost/isonomicus_1.2/14476001000111/prefeitura/929.23578000100/getPrefeitura?prefeitura_cnpj=929235800010&chave_acesso=202cb962ac59075b964b07152d234b70


Esta outra classe de serviço ficou assim:
 
  1. <?php
  2. /**
  3. * City REST service
  4. */
  5. class PrefeituraService extends AdiantiRecordService
  6. {
  7. const DATABASE = 'isonomicus';
  8. const ACTIVE_RECORD = 'Prefeitura';
  9. /**
  10. * getPrefeitura($param)
  11. *
  12. * Retorna os dados de uma Prefeitura
  13. *
  14. * @return The Active Record as associative array
  15. * @param $param dados da URL
  16. */
  17. public function getPrefeitura($param)
  18. {
  19. TTransaction::open(self::DATABASE);
  20. //retirar ponto '.' para não causar erro e retornar todos os registros do banco
  21. //$param['id'] = str_replace('.', '', $param['id']);
  22. throw new Exception(str_replace(".", "", $param['id']));
  23. //checa permissao do acesso ao webservice
  24. if( WebserviceLog::checarPermissao($param) )
  25. {
  26. //pega a prefeitura que se quer consultar os dados
  27. $pref = Prefeitura::loadByCNPJ($param['prefeitura_cnpj']);
  28. //pega o credenciado que esta consumindo o webservice
  29. $dados = explode('/', $_SERVER['REQUEST_URI']);
  30. $cred = Credenciado::loadByCNPJ($dados[2]);
  31. //grava o log do webservice
  32. WebserviceLog::registrar($pref->id, $cred->id);
  33. //preenche os dados que devem ser enviados
  34. $object = new stdClass;
  35. $object->cnpj = $pref->cnpj;
  36. $object->nome = $pref->nome;
  37. $object->site = $pref->site;
  38. $object->tributos = array_column($pref->getTributos(), 'sigla');
  39. TTransaction::close();
  40. return $object;
  41. }
  42. }
  43. ?>
NR

Imagino que o problema não esteja na função getPrefeitura, visto que ela sempre retorna um único objeto, independente do parâmetro passado.

Provavelmente é o mapeamento da rota no htaccess que tá fazendo com que seja chamada a função loadAll.
RC

Olá Nataniel,
obrigado pela ajuda.
A função getPrefeitura retorna apenas um objeto, quando o parâmetro está correto.
Entretanto, todas as funções retornam todos os registro do banco se houver um ponto "." dentro do parâmetro.

Mesmo tentando retirar o ponto, como fiz na linha 24 da classe PrefeituraService, o erro persiste.
$param['id'] = str_replace('.', '', $param['id']);

Com relação ao htaccess, vou postá-lo aqui:

RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d #Adianti Framework Template default routes RewriteRule ^system-program-list$ index.php?class=SystemProgramList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^system-program-edit$ index.php?class=SystemProgramForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-program-ondelete$ index.php?class=SystemProgramList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^system-program-delete$ index.php?class=SystemProgramList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-program-list$ engine.php?class=SystemProgramList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-program-ondelete$ engine.php?class=SystemProgramList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-program-delete$ engine.php?class=SystemProgramList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-program-edit$ engine.php?class=SystemProgramForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-group-list$ index.php?class=SystemGroupList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^system-group-edit$ index.php?class=SystemGroupForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-group-ondelete$ index.php?class=SystemGroupList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^system-group-delete$ index.php?class=SystemGroupList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-group-list$ engine.php?class=SystemGroupList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-group-edit$ engine.php?class=SystemGroupForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-group-ondelete$ engine.php?class=SystemGroupList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-group-delete$ engine.php?class=SystemGroupList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^system-unit-list$ index.php?class=SystemUnitList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^system-unit-edit$ index.php?class=SystemUnitForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-unit-ondelete$ index.php?class=SystemUnitList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^system-unit-delete$ index.php?class=SystemUnitList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-unit-list$ engine.php?class=SystemUnitList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-unit-edit$ engine.php?class=SystemUnitForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-unit-ondelete$ engine.php?class=SystemUnitList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-unit-delete$ engine.php?class=SystemUnitList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^system-user-list$ index.php?class=SystemUserList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^system-user-edit$ index.php?class=SystemUserForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-user-ondelete$ index.php?class=SystemUserList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^system-user-delete$ index.php?class=SystemUserList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-user-list$ engine.php?class=SystemUserList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-user-edit$ engine.php?class=SystemUserForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-user-ondelete$ engine.php?class=SystemUserList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-user-delete$ engine.php?class=SystemUserList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^system-database-explorer$ index.php?class=SystemDatabaseExplorer&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-database-explorer$ engine.php?class=SystemDatabaseExplorer&%{QUERY_STRING} [NC] RewriteRule ^system-sqlpanel$ index.php?class=SystemSQLPanel&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-sqlpanel$ engine.php?class=SystemSQLPanel&%{QUERY_STRING} [NC] RewriteRule ^system-phpinfo$ index.php?class=SystemPHPInfoView&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-phpinfo$ engine.php?class=SystemPHPInfoView&%{QUERY_STRING} [NC] RewriteRule ^system-modules$ index.php?class=SystemModulesCheckView&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-modules$ engine.php?class=SystemModulesCheckView&%{QUERY_STRING} [NC] RewriteRule ^system-preferences$ index.php?class=SystemPreferenceForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-preferences$ engine.php?class=SystemPreferenceForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-document-upload$ index.php?class=SystemDocumentUploadForm&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-upload$ engine.php?class=SystemDocumentUploadForm&%{QUERY_STRING} [NC] RewriteRule ^system-document-list$ index.php?class=SystemDocumentList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^system-document-edit$ index.php?class=SystemDocumentForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-document-ondelete$ index.php?class=SystemDocumentList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^system-document-delete$ index.php?class=SystemDocumentList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-list$ engine.php?class=SystemDocumentList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-edit$ engine.php?class=SystemDocumentForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-ondelete$ engine.php?class=SystemDocumentList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-delete$ engine.php?class=SystemDocumentList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^system-document-category-list$ index.php?class=SystemDocumentCategoryFormList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^system-document-category-edit$ index.php?class=SystemDocumentCategoryFormList&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^system-document-category-ondelete$ index.php?class=SystemDocumentCategoryFormList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^system-document-category-delete$ index.php?class=SystemDocumentCategoryFormList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-category-list$ engine.php?class=SystemDocumentCategoryFormList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-category-edit$ engine.php?class=SystemDocumentCategoryFormList&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-category-ondelete$ engine.php?class=SystemDocumentCategoryFormList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-document-category-delete$ engine.php?class=SystemDocumentCategoryFormList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^system-access-log-stat$ index.php?class=SystemAccessLogStats&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-access-log-stat$ engine.php?class=SystemAccessLogStats&%{QUERY_STRING} [NC] RewriteRule ^system-access-log-list$ index.php?class=SystemAccessLogList&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-access-log-list$ engine.php?class=SystemAccessLogList&%{QUERY_STRING} [NC] RewriteRule ^system-change-log-list$ index.php?class=SystemChangeLogView&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-change-log-list$ engine.php?class=SystemChangeLogView&%{QUERY_STRING} [NC] RewriteRule ^system-sql-log-list$ index.php?class=SystemSqlLogList&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-sql-log-list$ engine.php?class=SystemSqlLogList&%{QUERY_STRING} [NC] RewriteRule ^system-php-log-list$ index.php?class=SystemPHPErrorLogView&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-php-log-list$ engine.php?class=SystemPHPErrorLogView&%{QUERY_STRING} [NC] RewriteRule ^system-shared-document-list$ index.php?class=SystemSharedDocumentList&%{QUERY_STRING} [NC] RewriteRule ^xhr-system-shared-document-list$ engine.php?class=SystemSharedDocumentList&%{QUERY_STRING} [NC] RewriteRule ^welcome-view$ index.php?class=WelcomeView&%{QUERY_STRING} [NC] RewriteRule ^xhr-welcome-view$ engine.php?class=WelcomeView&%{QUERY_STRING} [NC] RewriteRule ^login-form$ index.php?class=LoginForm&%{QUERY_STRING} [NC] RewriteRule ^xhr-login-form$ engine.php?class=LoginForm&%{QUERY_STRING} [NC] #AUTH routes RewriteRule ^auth/([A-Za-z0-9]*)/([A-Za-z0-9]*)$ rest.php?class=ApplicationAuthenticationRestService&method=getToken&login=$1&password=$2&%{QUERY_STRING} [NC] #Application specific routes RewriteRule ^contact-edit$ index.php?class=ContactForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^contact-list$ index.php?class=ContactList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^contact-ondelete$ index.php?class=ContactList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^contact-delete$ index.php?class=ContactList&method=Delete&%{QUERY_STRING} [NC] RewriteRule ^xhr-contact-edit$ engine.php?class=ContactForm&method=onEdit&%{QUERY_STRING} [NC] RewriteRule ^xhr-contact-list$ engine.php?class=ContactList&method=onReload&%{QUERY_STRING} [NC] RewriteRule ^xhr-contact-ondelete$ engine.php?class=ContactList&method=onDelete&%{QUERY_STRING} [NC] RewriteRule ^xhr-contact-delete$ engine.php?class=ContactList&method=Delete&%{QUERY_STRING} [NC] #RESTFUL routes RewriteRule ^contacts/([A-Za-z0-9]*)$ rest.php?class=ContactRestService&method=handle&id=$1&%{QUERY_STRING} [NC] RewriteRule ^contacts/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=ContactRestService&method=$2&id=$1&%{QUERY_STRING} [NC] RewriteRule ^contacts$ rest.php?class=ContactRestService&method=handle&%{QUERY_STRING} [NC] #RESTFUL routes TAKI PAGAMENTOS, CNPJ 14476001000111 RewriteRule ^14476001000111/contribuinte/([A-Za-z0-9]*)$ rest.php?class=ContribuinteService&method=handle&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/contribuinte/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=ContribuinteService&method=$2&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/contribuinte rest.php?class=ContribuinteService&method=handle&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/tributo/([A-Za-z0-9]*)$ rest.php?class=TributoService&method=handle&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/tributo/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=TributoService&method=$2&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/tributo rest.php?class=TributoService&method=handle&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/prefeitura/([A-Za-z0-9]*)$ rest.php?class=PrefeituraService&method=handle&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/prefeitura/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=PrefeituraService&method=$2&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/prefeitura rest.php?class=PrefeituraService&method=handle&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/atendimento/([A-Za-z0-9]*)$ rest.php?class=AtendimentoService&method=handle&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/atendimento/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=AtendimentoService&method=$2&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/atendimento rest.php?class=AtendimentoService&method=handle&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/pagamento/([A-Za-z0-9]*)$ rest.php?class=PagamentoService&method=handle&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/pagamento/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=PagamentoService&method=$2&id=$1&%{QUERY_STRING} [NC] RewriteRule ^14476001000111/pagamento rest.php?class=PagamentoService&method=handle&%{QUERY_STRING} [NC]
RC

Vou postar novamente, pois ficou mal formatado.

 
  1. <?php
  2. RewriteEngine On
  3. RewriteCond %{REQUEST_FILENAME} !-f
  4. RewriteCond %{REQUEST_FILENAME} !-d
  5. #Adianti Framework Template default routes
  6. RewriteRule ^system-program-list$ index.php?class=SystemProgramList&method=onReload&%{QUERY_STRING} [NC]
  7. RewriteRule ^system-program-edit$ index.php?class=SystemProgramForm&method=onEdit&%{QUERY_STRING} [NC]
  8. RewriteRule ^system-program-ondelete$ index.php?class=SystemProgramList&method=onDelete&%{QUERY_STRING} [NC]
  9. RewriteRule ^system-program-delete$ index.php?class=SystemProgramList&method=Delete&%{QUERY_STRING} [NC]
  10. RewriteRule ^xhr-system-program-list$ engine.php?class=SystemProgramList&method=onReload&%{QUERY_STRING} [NC]
  11. RewriteRule ^xhr-system-program-ondelete$ engine.php?class=SystemProgramList&method=onDelete&%{QUERY_STRING} [NC]
  12. RewriteRule ^xhr-system-program-delete$ engine.php?class=SystemProgramList&method=Delete&%{QUERY_STRING} [NC]
  13. RewriteRule ^xhr-system-program-edit$ engine.php?class=SystemProgramForm&method=onEdit&%{QUERY_STRING} [NC]
  14. RewriteRule ^system-group-list$ index.php?class=SystemGroupList&method=onReload&%{QUERY_STRING} [NC]
  15. RewriteRule ^system-group-edit$ index.php?class=SystemGroupForm&method=onEdit&%{QUERY_STRING} [NC]
  16. RewriteRule ^system-group-ondelete$ index.php?class=SystemGroupList&method=onDelete&%{QUERY_STRING} [NC]
  17. RewriteRule ^system-group-delete$ index.php?class=SystemGroupList&method=Delete&%{QUERY_STRING} [NC]
  18. RewriteRule ^xhr-system-group-list$ engine.php?class=SystemGroupList&method=onReload&%{QUERY_STRING} [NC]
  19. RewriteRule ^xhr-system-group-edit$ engine.php?class=SystemGroupForm&method=onEdit&%{QUERY_STRING} [NC]
  20. RewriteRule ^xhr-system-group-ondelete$ engine.php?class=SystemGroupList&method=onDelete&%{QUERY_STRING} [NC]
  21. RewriteRule ^xhr-system-group-delete$ engine.php?class=SystemGroupList&method=Delete&%{QUERY_STRING} [NC]
  22. RewriteRule ^system-unit-list$ index.php?class=SystemUnitList&method=onReload&%{QUERY_STRING} [NC]
  23. RewriteRule ^system-unit-edit$ index.php?class=SystemUnitForm&method=onEdit&%{QUERY_STRING} [NC]
  24. RewriteRule ^system-unit-ondelete$ index.php?class=SystemUnitList&method=onDelete&%{QUERY_STRING} [NC]
  25. RewriteRule ^system-unit-delete$ index.php?class=SystemUnitList&method=Delete&%{QUERY_STRING} [NC]
  26. RewriteRule ^xhr-system-unit-list$ engine.php?class=SystemUnitList&method=onReload&%{QUERY_STRING} [NC]
  27. RewriteRule ^xhr-system-unit-edit$ engine.php?class=SystemUnitForm&method=onEdit&%{QUERY_STRING} [NC]
  28. RewriteRule ^xhr-system-unit-ondelete$ engine.php?class=SystemUnitList&method=onDelete&%{QUERY_STRING} [NC]
  29. RewriteRule ^xhr-system-unit-delete$ engine.php?class=SystemUnitList&method=Delete&%{QUERY_STRING} [NC]
  30. RewriteRule ^system-user-list$ index.php?class=SystemUserList&method=onReload&%{QUERY_STRING} [NC]
  31. RewriteRule ^system-user-edit$ index.php?class=SystemUserForm&method=onEdit&%{QUERY_STRING} [NC]
  32. RewriteRule ^system-user-ondelete$ index.php?class=SystemUserList&method=onDelete&%{QUERY_STRING} [NC]
  33. RewriteRule ^system-user-delete$ index.php?class=SystemUserList&method=Delete&%{QUERY_STRING} [NC]
  34. RewriteRule ^xhr-system-user-list$ engine.php?class=SystemUserList&method=onReload&%{QUERY_STRING} [NC]
  35. RewriteRule ^xhr-system-user-edit$ engine.php?class=SystemUserForm&method=onEdit&%{QUERY_STRING} [NC]
  36. RewriteRule ^xhr-system-user-ondelete$ engine.php?class=SystemUserList&method=onDelete&%{QUERY_STRING} [NC]
  37. RewriteRule ^xhr-system-user-delete$ engine.php?class=SystemUserList&method=Delete&%{QUERY_STRING} [NC]
  38. RewriteRule ^system-database-explorer$ index.php?class=SystemDatabaseExplorer&%{QUERY_STRING} [NC]
  39. RewriteRule ^xhr-system-database-explorer$ engine.php?class=SystemDatabaseExplorer&%{QUERY_STRING} [NC]
  40. RewriteRule ^system-sqlpanel$ index.php?class=SystemSQLPanel&%{QUERY_STRING} [NC]
  41. RewriteRule ^xhr-system-sqlpanel$ engine.php?class=SystemSQLPanel&%{QUERY_STRING} [NC]
  42. RewriteRule ^system-phpinfo$ index.php?class=SystemPHPInfoView&%{QUERY_STRING} [NC]
  43. RewriteRule ^xhr-system-phpinfo$ engine.php?class=SystemPHPInfoView&%{QUERY_STRING} [NC]
  44. RewriteRule ^system-modules$ index.php?class=SystemModulesCheckView&%{QUERY_STRING} [NC]
  45. RewriteRule ^xhr-system-modules$ engine.php?class=SystemModulesCheckView&%{QUERY_STRING} [NC]
  46. RewriteRule ^system-preferences$ index.php?class=SystemPreferenceForm&method=onEdit&%{QUERY_STRING} [NC]
  47. RewriteRule ^xhr-system-preferences$ engine.php?class=SystemPreferenceForm&method=onEdit&%{QUERY_STRING} [NC]
  48. RewriteRule ^system-document-upload$ index.php?class=SystemDocumentUploadForm&%{QUERY_STRING} [NC]
  49. RewriteRule ^xhr-system-document-upload$ engine.php?class=SystemDocumentUploadForm&%{QUERY_STRING} [NC]
  50. RewriteRule ^system-document-list$ index.php?class=SystemDocumentList&method=onReload&%{QUERY_STRING} [NC]
  51. RewriteRule ^system-document-edit$ index.php?class=SystemDocumentForm&method=onEdit&%{QUERY_STRING} [NC]
  52. RewriteRule ^system-document-ondelete$ index.php?class=SystemDocumentList&method=onDelete&%{QUERY_STRING} [NC]
  53. RewriteRule ^system-document-delete$ index.php?class=SystemDocumentList&method=Delete&%{QUERY_STRING} [NC]
  54. RewriteRule ^xhr-system-document-list$ engine.php?class=SystemDocumentList&method=onReload&%{QUERY_STRING} [NC]
  55. RewriteRule ^xhr-system-document-edit$ engine.php?class=SystemDocumentForm&method=onEdit&%{QUERY_STRING} [NC]
  56. RewriteRule ^xhr-system-document-ondelete$ engine.php?class=SystemDocumentList&method=onDelete&%{QUERY_STRING} [NC]
  57. RewriteRule ^xhr-system-document-delete$ engine.php?class=SystemDocumentList&method=Delete&%{QUERY_STRING} [NC]
  58. RewriteRule ^system-document-category-list$ index.php?class=SystemDocumentCategoryFormList&method=onReload&%{QUERY_STRING} [NC]
  59. RewriteRule ^system-document-category-edit$ index.php?class=SystemDocumentCategoryFormList&method=onEdit&%{QUERY_STRING} [NC]
  60. RewriteRule ^system-document-category-ondelete$ index.php?class=SystemDocumentCategoryFormList&method=onDelete&%{QUERY_STRING} [NC]
  61. RewriteRule ^system-document-category-delete$ index.php?class=SystemDocumentCategoryFormList&method=Delete&%{QUERY_STRING} [NC]
  62. RewriteRule ^xhr-system-document-category-list$ engine.php?class=SystemDocumentCategoryFormList&method=onReload&%{QUERY_STRING} [NC]
  63. RewriteRule ^xhr-system-document-category-edit$ engine.php?class=SystemDocumentCategoryFormList&method=onEdit&%{QUERY_STRING} [NC]
  64. RewriteRule ^xhr-system-document-category-ondelete$ engine.php?class=SystemDocumentCategoryFormList&method=onDelete&%{QUERY_STRING} [NC]
  65. RewriteRule ^xhr-system-document-category-delete$ engine.php?class=SystemDocumentCategoryFormList&method=Delete&%{QUERY_STRING} [NC]
  66. RewriteRule ^system-access-log-stat$ index.php?class=SystemAccessLogStats&%{QUERY_STRING} [NC]
  67. RewriteRule ^xhr-system-access-log-stat$ engine.php?class=SystemAccessLogStats&%{QUERY_STRING} [NC]
  68. RewriteRule ^system-access-log-list$ index.php?class=SystemAccessLogList&%{QUERY_STRING} [NC]
  69. RewriteRule ^xhr-system-access-log-list$ engine.php?class=SystemAccessLogList&%{QUERY_STRING} [NC]
  70. RewriteRule ^system-change-log-list$ index.php?class=SystemChangeLogView&%{QUERY_STRING} [NC]
  71. RewriteRule ^xhr-system-change-log-list$ engine.php?class=SystemChangeLogView&%{QUERY_STRING} [NC]
  72. RewriteRule ^system-sql-log-list$ index.php?class=SystemSqlLogList&%{QUERY_STRING} [NC]
  73. RewriteRule ^xhr-system-sql-log-list$ engine.php?class=SystemSqlLogList&%{QUERY_STRING} [NC]
  74. RewriteRule ^system-php-log-list$ index.php?class=SystemPHPErrorLogView&%{QUERY_STRING} [NC]
  75. RewriteRule ^xhr-system-php-log-list$ engine.php?class=SystemPHPErrorLogView&%{QUERY_STRING} [NC]
  76. RewriteRule ^system-shared-document-list$ index.php?class=SystemSharedDocumentList&%{QUERY_STRING} [NC]
  77. RewriteRule ^xhr-system-shared-document-list$ engine.php?class=SystemSharedDocumentList&%{QUERY_STRING} [NC]
  78. RewriteRule ^welcome-view$ index.php?class=WelcomeView&%{QUERY_STRING} [NC]
  79. RewriteRule ^xhr-welcome-view$ engine.php?class=WelcomeView&%{QUERY_STRING} [NC]
  80. RewriteRule ^login-form$ index.php?class=LoginForm&%{QUERY_STRING} [NC]
  81. RewriteRule ^xhr-login-form$ engine.php?class=LoginForm&%{QUERY_STRING} [NC]
  82. #AUTH routes
  83. RewriteRule ^auth/([A-Za-z0-9]*)/([A-Za-z0-9]*)$ rest.php?class=ApplicationAuthenticationRestService&method=getToken&login=$1&password=$2&%{QUERY_STRING} [NC]
  84. #Application specific routes
  85. RewriteRule ^contact-edit$ index.php?class=ContactForm&method=onEdit&%{QUERY_STRING} [NC]
  86. RewriteRule ^contact-list$ index.php?class=ContactList&method=onReload&%{QUERY_STRING} [NC]
  87. RewriteRule ^contact-ondelete$ index.php?class=ContactList&method=onDelete&%{QUERY_STRING} [NC]
  88. RewriteRule ^contact-delete$ index.php?class=ContactList&method=Delete&%{QUERY_STRING} [NC]
  89. RewriteRule ^xhr-contact-edit$ engine.php?class=ContactForm&method=onEdit&%{QUERY_STRING} [NC]
  90. RewriteRule ^xhr-contact-list$ engine.php?class=ContactList&method=onReload&%{QUERY_STRING} [NC]
  91. RewriteRule ^xhr-contact-ondelete$ engine.php?class=ContactList&method=onDelete&%{QUERY_STRING} [NC]
  92. RewriteRule ^xhr-contact-delete$ engine.php?class=ContactList&method=Delete&%{QUERY_STRING} [NC]
  93. #RESTFUL routes
  94. RewriteRule ^contacts/([A-Za-z0-9]*)$ rest.php?class=ContactRestService&method=handle&id=$1&%{QUERY_STRING} [NC]
  95. RewriteRule ^contacts/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=ContactRestService&method=$2&id=$1&%{QUERY_STRING} [NC]
  96. RewriteRule ^contacts$ rest.php?class=ContactRestService&method=handle&%{QUERY_STRING} [NC]
  97. #RESTFUL routes
  98. RewriteRule ^14476001000111/contribuinte/([A-Za-z0-9]*)$ rest.php?class=ContribuinteService&method=handle&id=$1&%{QUERY_STRING} [NC]
  99. RewriteRule ^14476001000111/contribuinte/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=ContribuinteService&method=$2&id=$1&%{QUERY_STRING} [NC]
  100. RewriteRule ^14476001000111/contribuinte rest.php?class=ContribuinteService&method=handle&%{QUERY_STRING} [NC]
  101. RewriteRule ^14476001000111/tributo/([A-Za-z0-9]*)$ rest.php?class=TributoService&method=handle&id=$1&%{QUERY_STRING} [NC]
  102. RewriteRule ^14476001000111/tributo/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=TributoService&method=$2&id=$1&%{QUERY_STRING} [NC]
  103. RewriteRule ^14476001000111/tributo rest.php?class=TributoService&method=handle&%{QUERY_STRING} [NC]
  104. RewriteRule ^14476001000111/prefeitura/([A-Za-z0-9]*)$ rest.php?class=PrefeituraService&method=handle&id=$1&%{QUERY_STRING} [NC]
  105. RewriteRule ^14476001000111/prefeitura/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=PrefeituraService&method=$2&id=$1&%{QUERY_STRING} [NC]
  106. RewriteRule ^14476001000111/prefeitura rest.php?class=PrefeituraService&method=handle&%{QUERY_STRING} [NC]
  107. RewriteRule ^14476001000111/atendimento/([A-Za-z0-9]*)$ rest.php?class=AtendimentoService&method=handle&id=$1&%{QUERY_STRING} [NC]
  108. RewriteRule ^14476001000111/atendimento/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=AtendimentoService&method=$2&id=$1&%{QUERY_STRING} [NC]
  109. RewriteRule ^14476001000111/atendimento rest.php?class=AtendimentoService&method=handle&%{QUERY_STRING} [NC]
  110. RewriteRule ^14476001000111/pagamento/([A-Za-z0-9]*)$ rest.php?class=PagamentoService&method=handle&id=$1&%{QUERY_STRING} [NC]
  111. RewriteRule ^14476001000111/pagamento/([A-Za-z-_0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=PagamentoService&method=$2&id=$1&%{QUERY_STRING} [NC]
  112. RewriteRule ^14476001000111/pagamento rest.php?class=PagamentoService&method=handle&%{QUERY_STRING} [NC]
  113. ?>
NR

Parâmetros quando digitado o ponto:
 
  1. <?php
  2. array(4) {
  3. ["class"]=>
  4. string(17) "PrefeituraService"
  5. ["method"]=>
  6. string(6) "handle"
  7. ["prefeitura_cnpj"]=>
  8. string(12) "929235800010"
  9. ["chave_acesso"]=>
  10. string(32) "202cb962ac59075b964b07152d234b70"
  11. }
  12. ?>

Parâmetros sem ponto:
 
  1. <?php
  2. array(5) {
  3. ["class"]=>
  4. string(17) "PrefeituraService"
  5. ["method"]=>
  6. string(13) "getPrefeitura"
  7. ["id"]=>
  8. string(14) "92923578000100"
  9. ["prefeitura_cnpj"]=>
  10. string(12) "929235800010"
  11. ["chave_acesso"]=>
  12. string(32) "202cb962ac59075b964b07152d234b70"
  13. }
  14. ?>

Note que quando há ponto, method = handle e a chave "id" não é setada. E não havendo "id", a função handle chama loadAll.

Isso acontece porque no htaccess "[A-Za-z-_0-9]" não considera nada além de letras e números, com isso o ponto faz com que seja utilizada a última regra, que usa a função handle.
RC

Perfeito Nataniel,
segue suas orientações e o erro foi corrigido.
Meu htaccess ficou assim
 
  1. <?php
  2. RewriteRule ^14476001000111/atendimento/([A-Za-z0-9]*)$ rest.php?class=AtendimentoService&method=handle&id=$1&%{QUERY_STRING} [NC]
  3. RewriteRule ^14476001000111/atendimento/([A-Za-z-_.0-9]*)/([A-Za-z-_0-9]*)$ rest.php?class=AtendimentoService&method=$2&id=$1&%{QUERY_STRING} [NC]
  4. RewriteRule ^14476001000111/atendimento rest.php?class=AtendimentoService&method=handle&%{QUERY_STRING} [NC]
  5. ?>


Então quando coloco o ponto na requisição o webservice retorna:
{ "status": "error", "data": "Nenhum atendimento aberto para o contribuinte 4587.9946151" }


Muito obrigado pela ajuda.