webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Fixed test class names + add perm. check to api session auth

Browse Source
This commit is contained in:
Dan Brown
2020-01-01 17:01:36 +00:00
parent a7a97a53f1
commit a8595d8aaf
4 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/Http/Middleware/ApiAuthenticate.php
View File

@ -2,6 +2,7 @@
namespace BookStack\Http\Middleware;
use BookStack\Exceptions\ApiAuthException;
use BookStack\Exceptions\UnauthorizedException;
use Closure;
use Illuminate\Http\Request;
@ -36,6 +37,9 @@ class ApiAuthenticate
// This is to make it easy to browser the API via browser after just logging into the system.
if (signedInUser()) {
$this->ensureEmailConfirmedIfRequested();
if (!auth()->user()->can('access-api')) {
throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
}
return;
}