friendica/friendica
6
0
Fork 1
mirror of https://github.com/friendica/friendica synced 2024-06-24 12:30:35 +02:00
Code Issues Packages Projects Releases 1 Wiki Activity

Issue 11101: Fix API authentification

Browse source
This commit is contained in:
Michael 2021-12-17 07:04:52 +00:00
parent 0165811f09
commit 0a3026abce
2 changed files with 19 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/Module/Api/Mastodon/Apps.php
View file

@ -26,12 +26,17 @@ use Friendica\Database\DBA;
use Friendica\DI; use Friendica\DI;
use Friendica\Module\BaseApi; use Friendica\Module\BaseApi;
use Friendica\Util\Network; use Friendica\Util\Network;
use Psr\Http\Message\ResponseInterface;
/** /**
* Apps class to register new OAuth clients * Apps class to register new OAuth clients
*/ */
class Apps extends BaseApi class Apps extends BaseApi
{ {
public function run(array $request = [], bool $scopecheck = true): ResponseInterface
{
return parent::run($request, false);
}
/** /**
* @throws \Friendica\Network\HTTPException\InternalServerErrorException * @throws \Friendica\Network\HTTPException\InternalServerErrorException
*/ */

26
src/Module/BaseApi.php
View file

@ -79,19 +79,21 @@ class BaseApi extends BaseModule
* *
* @throws HTTPException\ForbiddenException * @throws HTTPException\ForbiddenException
*/ */
public function run(array $request = []): ResponseInterface public function run(array $request = [], bool $scopecheck = true): ResponseInterface
{ {
switch ($this->server['REQUEST_METHOD'] ?? Router::GET) { if ($scopecheck) {
case Router::DELETE: switch ($this->server['REQUEST_METHOD'] ?? Router::GET) {
case Router::PATCH: case Router::DELETE:
case Router::POST: case Router::PATCH:
case Router::PUT: case Router::POST:
self::checkAllowedScope(self::SCOPE_WRITE); case Router::PUT:
self::checkAllowedScope(self::SCOPE_WRITE);
if (!self::getCurrentUserID()) {
throw new HTTPException\ForbiddenException($this->t('Permission denied.')); if (!self::getCurrentUserID()) {
} throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
break; }
break;
}
} }
return parent::run($request); return parent::run($request);