From ff051e2106bb44203736934547a7a2c501b1a784 Mon Sep 17 00:00:00 2001 From: Unknwon Date: Wed, 15 Jul 2015 19:17:57 +0800 Subject: #1128: API calls are not hidden behind sign in --- modules/middleware/auth.go | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'modules/middleware/auth.go') diff --git a/modules/middleware/auth.go b/modules/middleware/auth.go index 8f86b791..2a02d276 100644 --- a/modules/middleware/auth.go +++ b/modules/middleware/auth.go @@ -10,6 +10,7 @@ import ( "github.com/Unknwon/macaron" "github.com/macaron-contrib/csrf" + "github.com/gogits/gogs/modules/auth" "github.com/gogits/gogs/modules/setting" ) @@ -49,6 +50,12 @@ func Toggle(options *ToggleOptions) macaron.Handler { if options.SignInRequire { if !ctx.IsSigned { + // Restrict API calls with error message. + if auth.IsAPIPath(ctx.Req.URL.Path) { + ctx.HandleAPI(403, "Only signed in user is allowed to call APIs.") + return + } + ctx.SetCookie("redirect_to", url.QueryEscape(setting.AppSubUrl+ctx.Req.RequestURI), 0, setting.AppSubUrl) ctx.Redirect(setting.AppSubUrl + "/user/login") return -- cgit v1.2.3