From ff051e2106bb44203736934547a7a2c501b1a784 Mon Sep 17 00:00:00 2001 From: Unknwon Date: Wed, 15 Jul 2015 19:17:57 +0800 Subject: [PATCH] #1128: API calls are not hidden behind sign in --- cmd/web.go | 2 +- conf/locale/TRANSLATORS | 1 + gogs.go | 2 +- modules/auth/auth.go | 6 +++++- modules/middleware/auth.go | 7 +++++++ templates/.VERSION | 2 +- 6 files changed, 16 insertions(+), 4 deletions(-) diff --git a/cmd/web.go b/cmd/web.go index ca4a6291b2..db1bf98af4 100644 --- a/cmd/web.go +++ b/cmd/web.go @@ -242,7 +242,7 @@ func runWeb(ctx *cli.Context) { ctx.HandleAPI(404, "Page not found") }) }) - }) + }, ignSignIn) // User. m.Group("/user", func() { diff --git a/conf/locale/TRANSLATORS b/conf/locale/TRANSLATORS index 1c2768afdb..733c4ef435 100644 --- a/conf/locale/TRANSLATORS +++ b/conf/locale/TRANSLATORS @@ -8,6 +8,7 @@ Huimin Wang Thomas Fanninger Ɓukasz Jan Niemier Lafriks +Luc Stepniewski Miguel de la Cruz Natan Albuquerque Marc Schiller diff --git a/gogs.go b/gogs.go index 958792e0d6..1fe0153e65 100644 --- a/gogs.go +++ b/gogs.go @@ -17,7 +17,7 @@ import ( "github.com/gogits/gogs/modules/setting" ) -const APP_VER = "0.6.1.0714 Beta" +const APP_VER = "0.6.1.0715 Beta" func init() { runtime.GOMAXPROCS(runtime.NumCPU()) diff --git a/modules/auth/auth.go b/modules/auth/auth.go index edcb13069e..4234643023 100644 --- a/modules/auth/auth.go +++ b/modules/auth/auth.go @@ -21,6 +21,10 @@ import ( "github.com/gogits/gogs/modules/uuid" ) +func IsAPIPath(url string) bool { + return strings.HasPrefix(url, "/api/") +} + // SignedInId returns the id of signed in user. func SignedInId(req *http.Request, sess session.Store) int64 { if !models.HasEngine { @@ -28,7 +32,7 @@ func SignedInId(req *http.Request, sess session.Store) int64 { } // API calls need to check access token. - if strings.HasPrefix(req.URL.Path, "/api/") { + if IsAPIPath(req.URL.Path) { auHead := req.Header.Get("Authorization") if len(auHead) > 0 { auths := strings.Fields(auHead) diff --git a/modules/middleware/auth.go b/modules/middleware/auth.go index 8f86b79177..2a02d27607 100644 --- a/modules/middleware/auth.go +++ b/modules/middleware/auth.go @@ -10,6 +10,7 @@ import ( "github.com/Unknwon/macaron" "github.com/macaron-contrib/csrf" + "github.com/gogits/gogs/modules/auth" "github.com/gogits/gogs/modules/setting" ) @@ -49,6 +50,12 @@ func Toggle(options *ToggleOptions) macaron.Handler { if options.SignInRequire { if !ctx.IsSigned { + // Restrict API calls with error message. + if auth.IsAPIPath(ctx.Req.URL.Path) { + ctx.HandleAPI(403, "Only signed in user is allowed to call APIs.") + return + } + ctx.SetCookie("redirect_to", url.QueryEscape(setting.AppSubUrl+ctx.Req.RequestURI), 0, setting.AppSubUrl) ctx.Redirect(setting.AppSubUrl + "/user/login") return diff --git a/templates/.VERSION b/templates/.VERSION index 627dda90e4..815ab4178c 100644 --- a/templates/.VERSION +++ b/templates/.VERSION @@ -1 +1 @@ -0.6.1.0714 Beta \ No newline at end of file +0.6.1.0715 Beta \ No newline at end of file