G'day Guys,

Tonight we shipped some new functionality for api version 1.2.2...
http://wiki.smugmug.net/display/API/API+1.2.2

Coupons
- Added album restrictions support for coupons.
- smugmug.coupons.create and smugmug.coupons.modify now appect an AlbumIDs parameter...a comma separated string of AlbumIDs to restrict the coupon to.
- also added smugmug.coupons.restrictions.albums.add and smugmug.coupons.restrictions.albums.remove to modify restrictions on an individual basis
- smugmug.coupons.get and smugmug.coupons.getInfo now return a Restrictions element if any restrictions exist.

BoutiquePackaging
- Added boutique packaging support to all album methods.

FeaturedAlbums
- Added smugmug.featured.albums.get

Cheers,

David

Originally Posted by devbobo G'day Guys, Tonight we shipped some new functionality for api version 1.2.2... Coupons - Added album restrictions support for coupons. - smugmug.coupons.create and smugmug.coupons.modify now appect an AlbumIDs parameter...a comma separated string of AlbumIDs to restrict the coupon to. - also added smugmug.coupons.restrictions.albums.add and smugmug.coupons.restrictions.albums.remove to modify restrictions on an individual basis - smugmug.coupons.get and smugmug.coupons.getInfo now return a Restrictions element if any restrictions exist. BoutiquePackaging - Added boutique packaging support to all album methods. FeaturedAlbums - Added smugmug.featured.albums.get Cheers, David

Any changes to just logging in? I cannot connect via API.

Getting a System.Xml.XmlException: Root element is missing on login.

Well... my app is now reporting invalid api key... where it worked earlier. I'm not using oauth. That error actually failed my app in windows phone certification. Did anything change around keys?

Originally Posted by devbobo G'day Guys, Tonight we shipped some new functionality for api version 1.2.2... Coupons - Added album restrictions support for coupons. - smugmug.coupons.create and smugmug.coupons.modify now appect an AlbumIDs parameter...a comma separated string of AlbumIDs to restrict the coupon to. - also added smugmug.coupons.restrictions.albums.add and smugmug.coupons.restrictions.albums.remove to modify restrictions on an individual basis - smugmug.coupons.get and smugmug.coupons.getInfo now return a Restrictions element if any restrictions exist. BoutiquePackaging - Added boutique packaging support to all album methods. FeaturedAlbums - Added smugmug.featured.albums.get Cheers, David

Nothing changed from an API perspective with respect to logging in...but some work has been done on 'logging in' further down our stack. I've just double checked a few random apps that use basic auth...and they all seem to be working fine.

If your app is using an existing session, I suggest that you reset any SessionIDs or cookies that might be in use and obtain a new SessionID.

Cheers,

David

Originally Posted by devbobo Nothing changed from an API perspective with respect to logging in...but some work has been done on 'logging in' further down our stack. I've just double checked a few random apps that use basic auth...and they all seem to be working fine. If your app is using an existing session, I suggest that you reset any SessionIDs or cookies that might be in use and obtain a new SessionID. Cheers, David

Just tried again and getting "Root element is missing."

Code that's worked for many many months is now failing post-update.

Thie login is broken for many of my users including myself...

JSON: {
"message": "invalid user",
"method": "smugmug.albums.get",
"stat": "fail",
"code": 4
}

This is with accounts that were working before the API upgrade.

Can we get this fixed?

Thanks,

Brian

Technically, the log in is returning OK. It is the the albums.get call that is not liking the resulting session id that is generated from the login. There is no caching of old sessions in my app.

Login returns:

JSON: {
"Login": {
"User": {
"URL": "http:\/\/photos.snapwoodstudios.com",
"DisplayName": "radian09",
"id": 111111,
"NickName": "radian09"
},
"AccountStatus": "Active",
"PasswordHash": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"SmugVault": false,
"Session": {
"id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
},
"FileSizeLimit": 25165824,
"AccountType": "Pro"
},
"method": "smugmug.login.withPassword",
"stat": "ok"
}

Get albums returns:

JSON: {
"message": "invalid user",
"method": "smugmug.albums.get",
"stat": "fail",
"code": 4
}

Thats what im seeing to

As stated earlier, changes were made to our 'login' functionality lower in our stack than the api.

Developers who are experiencing issues are most likely not calling login methods over https. I'm working on a new release that will throw the correct error message.

Cheers,

David

That is a bad assumption. Here are my urls with the responses. I am using HTTPS:

https://api.smugmug.com/services/api...PIKey=myapikey
JSON: {
"Login": {
"User": {
"URL": "http:\/\/photos.snapwoodstudios.com",
"DisplayName": "radian09",
"id": 567279,
"NickName": "radian09"
},
"AccountStatus": "Active",
"PasswordHash": "xxxxxxxxxxxxxxxxxxxxxxxx",
"SmugVault": false,
"Session": {
"id": "xxxxxxxxxxxxxxx"
},
"FileSizeLimit": 25165824,
"AccountType": "Pro"
},
"method": "smugmug.login.withPassword",
"stat": "ok"
}

https://api.smugmug.com/services/api...xxxxxxxxxxxxxx
JSON: {
"message": "invalid user",
"method": "smugmug.albums.get",
"stat": "fail",
"code": 4
}

Same here. All my requests have the root url:[FONT=Consolas][FONT=Consolas][FONT=Consolas]
https://secure.smugmug.com/services/api/json/1.2.2/[/FONT][/FONT][/FONT][FONT=Consolas][FONT=Consolas]
[/FONT][/FONT]

Originally Posted by devbobo As stated earlier, changes were made to our 'login' functionality lower in our stack than the api. Developers who are experiencing issues are most likely not calling login methods over https. I'm working on a new release that will throw the correct error message. Cheers, David

That's it, right there! I was using HTTP Login in my iPhone app.... My iPhone app is now broken. I need to update to HTTPS and re-submit it.... it's gonna take a week until it's on the App Store again...
Is that by any chance possible to keep the HTTP login method enabled for another week or so, so that developers have time to re-submit their app to Apple ? Would be amazing!

Thanks,
Greg.

Originally Posted by snapwood That is a bad assumption. Here are my urls with the responses. I am using HTTPS

it might not be the cause of your issue, but I can guarantee that numerous apps are currently failing for that reason.

I'm currently investigating your problem, I need to reproduce internally before I can work out what is going on.

Thank you! This is the second time in less than a month that 'changes' have broken mine (and other) apps. I would be happy to test these changes before rollout if there was a method. I'd be happy to submit tests (or point you to how to run our apps) if that would help. Basically I'll do anything to avoid breakages like this...

Thanks,

Brian

Originally Posted by quiks That's it, right there! I was using HTTP Login in my iPhone app.... My iPhone app is now broken. I need to update to HTTPS and re-submit it.... it's gonna take a week until it's on the App Store again... Is that by any chance possible to keep the HTTP login method enabled for another week or so, so that developers have time to re-submit their app to Apple ? Would be amazing! Thanks, Greg.

Hey Greg,

I'd love to help out...but the recent changes were in relation to side jacking exploits. And I think I'd have a tough time getting the changes rolled back.

Sorry,

David

Thanks for being on it david.
I'm curious, what IS a side jacking exploit?

Originally Posted by blackgold9 Thanks for being on it david. I'm curious, what IS a side jacking exploit?

just google side jacking or firesheep.

Brian/Stephen,

I've reproduced the issue internally and have tracked down where the problem is...but I need to get more info on the recent underlying changes and that person is currently asleep.

One workaround is to only request login methods over https, and make all other calls over http.

Hope this helps a little bit.

Cheers,

David

Heading to bed, just a recap for everyone...

- calls to smugmug.login.* need to be done over https
- all other calls should be done over http (temporary workaround)

Cheers,

David

Originally Posted by devbobo Heading to bed, just a recap for everyone... - calls to smugmug.login.* need to be done over https - all other calls should be done over http (temporary workaround) Cheers, David

Just tried it again and it worked... Still using http