<?php
    require '../_includes/SecurityData.php';

    /**
     * Gets the pads
     *
     * @return Array the pads list
     */
    function get_pads () {
        $key = SecurityData::getSecret('etherpad.api.key');
        $url = "http://pad.wolfplex.be/api/1.2.1/listAllPads?apikey=" . $key;
        $api_reply = json_decode(file_get_contents($url));
        if ($api_reply->code == 0) {
            return $api_reply->data->padIDs;
        }
        throw new Exception("API fatal error: $api_reply->message");
    }

    $format = array_key_exists('format', $_GET) ? $_GET['format'] : '';
    switch ($format) {
        case "":
        case "json":
            echo json_encode(get_pads());
            break;

        case "raw":
            echo implode("\n", get_pads());
            break;

        case "txt":
            header("Content-Type: text/plain");
            foreach (get_pads() as $pad) {
                echo "* $pad\n";
            }
            break;

        default:
            die("Unknown format: $format");
    }
?>
<?php
    /**
     * Gets the pads
     *
     * @return Array the pads list
     */
    function get_pads () {
        //TODO: move API key in config
        $url = "http://pad.wolfplex.be/api/1.2.1/listAllPads?apikey=U67yKTUDzz19fEHyrAuNN4zUnKxbOJZu";
        $api_reply = json_decode(file_get_contents($url));
        if ($api_reply->code == 0) {
            return $api_reply->data->padIDs;
        }
        throw new Exception("API fatal error: $api_reply->message");
    }

    $format = array_key_exists('format', $_GET) ? $_GET['format'] : '';
    switch ($format) {
        case "":
        case "json":
            echo json_encode(get_pads());
            break;

        case "raw":
            echo implode("\n", get_pads());
            break;

        case "txt":
            header("Content-Type: text/plain");
            foreach (get_pads() as $pad) {
                echo "* $pad\n";
            }
            break;

        default:
            die("Unknown format: $format");
    }
?>
--- 
+++ 
@@ -1,12 +1,14 @@
 <?php
+    require '../_includes/SecurityData.php';
+
     /**
      * Gets the pads
      *
      * @return Array the pads list
      */
     function get_pads () {
-        //TODO: move API key in config
-        $url = "http://pad.wolfplex.be/api/1.2.1/listAllPads?apikey=U67yKTUDzz19fEHyrAuNN4zUnKxbOJZu";
+        $key = SecurityData::getSecret('etherpad.api.key');
+        $url = "http://pad.wolfplex.be/api/1.2.1/listAllPads?apikey=" . $key;
         $api_reply = json_decode(file_get_contents($url));
         if ($api_reply->code == 0) {
             return $api_reply->data->padIDs;
Store the Etherpad API key as a secret.

Currently, the Etherpad API key were public, with the rationale the
installation is a public one, everybody can anonymously or with a name
make edits, destroy pads, create new pads, etc.

Nasqueron is interested to get the potential to integrate other applications
with Etherpad, using groups, sessions and users objects to make pads spawned
by 3rd party application private.

A private API key has so been regenerated, and we now store it as a secret.
