strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #11106 from annando/issue-11101

Browse source 
Issue 11101: Fix API authentification
This commit is contained in:
Philipp 2021-12-17 09:09:15 +01:00 committed by GitHub
parent 8ab1306067 0a3026abce
commit 9f401a5952
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/Module/Api/Mastodon/Apps.php
View file

@ -26,12 +26,17 @@ use Friendica\Database\DBA;
use Friendica\DI;
use Friendica\Module\BaseApi;
use Friendica\Util\Network;
use Psr\Http\Message\ResponseInterface;
/**
* Apps class to register new OAuth clients
*/
class Apps extends BaseApi
{
public function run(array $request = [], bool $scopecheck = true): ResponseInterface
{
return parent::run($request, false);
}
/**
* @throws \Friendica\Network\HTTPException\InternalServerErrorException
*/

26
src/Module/BaseApi.php
View file

@ -79,19 +79,21 @@ class BaseApi extends BaseModule
*
* @throws HTTPException\ForbiddenException
*/
public function run(array $request = []): ResponseInterface
public function run(array $request = [], bool $scopecheck = true): ResponseInterface
{
switch ($this->server['REQUEST_METHOD'] ?? Router::GET) {
case Router::DELETE:
case Router::PATCH:
case Router::POST:
case Router::PUT:
self::checkAllowedScope(self::SCOPE_WRITE);
if (!self::getCurrentUserID()) {
throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
}
break;
if ($scopecheck) {
switch ($this->server['REQUEST_METHOD'] ?? Router::GET) {
case Router::DELETE:
case Router::PATCH:
case Router::POST:
case Router::PUT:
self::checkAllowedScope(self::SCOPE_WRITE);
if (!self::getCurrentUserID()) {
throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
}
break;
}
}
return parent::run($request);