From b4d97bc26baff0a9867f1e510a7630dd34b8049d Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Tue, 30 Jul 2019 11:10:46 +0200
Subject: port tootsuite#11292 to monsterfork: Add whitelist mode
---
app/controllers/api/base_controller.rb | 9 +++++++++
app/controllers/api/v1/accounts_controller.rb | 2 ++
app/controllers/api/v1/apps_controller.rb | 2 ++
app/controllers/api/v1/instances/activity_controller.rb | 3 ++-
app/controllers/api/v1/instances/peers_controller.rb | 3 ++-
app/controllers/api/v1/instances_controller.rb | 1 +
6 files changed, 18 insertions(+), 2 deletions(-)
(limited to 'app/controllers/api')
diff --git a/app/controllers/api/base_controller.rb b/app/controllers/api/base_controller.rb
index b8f7c58cc..144fdd6ac 100644
--- a/app/controllers/api/base_controller.rb
+++ b/app/controllers/api/base_controller.rb
@@ -9,6 +9,7 @@ class Api::BaseController < ApplicationController
skip_before_action :store_current_location
skip_before_action :require_functional!
+ before_action :require_authenticated_user!, if: :disallow_unauthenticated_api_access?
before_action :set_cache_headers
protect_from_forgery with: :null_session
@@ -83,6 +84,10 @@ class Api::BaseController < ApplicationController
nil
end
+ def require_authenticated_user!
+ render json: { error: 'This API requires an authenticated user' }, status: 401 unless current_user
+ end
+
def require_user!
if !current_user
render json: { error: 'This method requires an authenticated user' }, status: 422
@@ -108,4 +113,8 @@ class Api::BaseController < ApplicationController
def set_cache_headers
response.headers['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate'
end
+
+ def disallow_unauthenticated_api_access?
+ authorized_fetch_mode?
+ end
end
diff --git a/app/controllers/api/v1/accounts_controller.rb b/app/controllers/api/v1/accounts_controller.rb
index 5fc3d9606..5effacb26 100644
--- a/app/controllers/api/v1/accounts_controller.rb
+++ b/app/controllers/api/v1/accounts_controller.rb
@@ -12,6 +12,8 @@ class Api::V1::AccountsController < Api::BaseController
before_action :check_account_suspension, only: [:show]
before_action :check_enabled_registrations, only: [:create]
+ skip_before_action :require_authenticated_user!, only: :create
+
respond_to :json
def show
diff --git a/app/controllers/api/v1/apps_controller.rb b/app/controllers/api/v1/apps_controller.rb
index eb163f38f..d73f61509 100644
--- a/app/controllers/api/v1/apps_controller.rb
+++ b/app/controllers/api/v1/apps_controller.rb
@@ -1,6 +1,8 @@
# frozen_string_literal: true
class Api::V1::AppsController < Api::BaseController
+ skip_before_action :require_authenticated_user!
+
def create
@app = Doorkeeper::Application.create!(application_options)
render json: @app, serializer: REST::ApplicationSerializer, monsterfork_api: monsterfork_api
diff --git a/app/controllers/api/v1/instances/activity_controller.rb b/app/controllers/api/v1/instances/activity_controller.rb
index cd15d1231..b30e8464c 100644
--- a/app/controllers/api/v1/instances/activity_controller.rb
+++ b/app/controllers/api/v1/instances/activity_controller.rb
@@ -2,6 +2,7 @@
class Api::V1::Instances::ActivityController < Api::BaseController
before_action :require_enabled_api!
+
skip_before_action :set_cache_headers
skip_before_action :require_authenticated_user!, unless: :whitelist_mode?
@@ -34,6 +35,6 @@ class Api::V1::Instances::ActivityController < Api::BaseController
end
def require_enabled_api!
- head 404 unless Setting.activity_api_enabled
+ head 404 unless Setting.activity_api_enabled && !whitelist_mode?
end
end
diff --git a/app/controllers/api/v1/instances/peers_controller.rb b/app/controllers/api/v1/instances/peers_controller.rb
index ae75f6647..3a4c11783 100644
--- a/app/controllers/api/v1/instances/peers_controller.rb
+++ b/app/controllers/api/v1/instances/peers_controller.rb
@@ -2,6 +2,7 @@
class Api::V1::Instances::PeersController < Api::BaseController
before_action :require_enabled_api!
+
skip_before_action :set_cache_headers
skip_before_action :require_authenticated_user!, unless: :whitelist_mode?
@@ -20,6 +21,6 @@ class Api::V1::Instances::PeersController < Api::BaseController
end
def require_enabled_api!
- head 404 unless Setting.peers_api_enabled
+ head 404 unless Setting.peers_api_enabled && !whitelist_mode?
end
end
diff --git a/app/controllers/api/v1/instances_controller.rb b/app/controllers/api/v1/instances_controller.rb
index 5dec79906..c323b60b4 100644
--- a/app/controllers/api/v1/instances_controller.rb
+++ b/app/controllers/api/v1/instances_controller.rb
@@ -2,6 +2,7 @@
class Api::V1::InstancesController < Api::BaseController
respond_to :json
+
skip_before_action :set_cache_headers
skip_before_action :require_authenticated_user!, unless: :whitelist_mode?
--
cgit