webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Updated API session auth to consider public access setting

Browse Source 
For #3091
This commit is contained in:
Dan Brown
2021-11-30 13:55:56 +00:00
parent b4fa82e329
commit 3b3eb0f44f
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
app/Http/Middleware/ApiAuthenticate.php
View File

@ -35,7 +35,7 @@ class ApiAuthenticate
// Return if the user is already found to be signed in via session-based auth.
// This is to make it easy to browser the API via browser after just logging into the system.
if (signedInUser() || session()->isStarted()) {
if (!user()->can('access-api')) {
if (!$this->sessionUserHasApiAccess()) {
throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
}
@ -49,6 +49,15 @@ class ApiAuthenticate
auth()->authenticate();
}
/**
* Check if the active session user has API access
*/
protected function sessionUserHasApiAccess(): bool
{
$hasApiPermission = user()->can('access-api');
return $hasApiPermission && hasAppAccess();
}
/**
* Provide a standard API unauthorised response.
*/