meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-03-03 15:53:05 +00:00
Code Issues Releases Wiki Activity

Use HTTP status code 403 instead of 401 when REST API is disabled (#30086).

Browse Source 
Patch by Yuichi HARADA.


git-svn-id: http://svn.redmine.org/redmine/trunk@18055 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA 2019-04-10 02:51:28 +00:00
parent 7cf16d4abd
commit 6ef0a4c4cc
2 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/application_controller.rb
View File

@ -231,9 +231,14 @@ class ApplicationController < ActionController::Base
format.any(:atom, :pdf, :csv) {
redirect_to signin_path(:back_url => url)
}
format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
format.api {
if Setting.rest_api_enabled? && accept_api_auth?
head(:unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"')
else
head(:forbidden)
end
}
format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
format.any { head :unauthorized }
end
return false

12
test/integration/api_test/disabled_rest_api_test.rb
View File

@ -43,11 +43,11 @@ class Redmine::ApiTest::DisabledRestApiTest < Redmine::ApiTest::Base
@token = Token.create!(:user => @user, :action => 'api')
get "/news.xml?key=#{@token.value}"
assert_response :unauthorized
assert_response :forbidden
assert_equal User.anonymous, User.current
get "/news.json?key=#{@token.value}"
assert_response :unauthorized
assert_response :forbidden
assert_equal User.anonymous, User.current
end
@ -57,11 +57,11 @@ class Redmine::ApiTest::DisabledRestApiTest < Redmine::ApiTest::Base
end
get "/news.xml", :headers => credentials(@user.login, 'my_password')
assert_response :unauthorized
assert_response :forbidden
assert_equal User.anonymous, User.current
get "/news.json", :headers => credentials(@user.login, 'my_password')
assert_response :unauthorized
assert_response :forbidden
assert_equal User.anonymous, User.current
end
@ -70,11 +70,11 @@ class Redmine::ApiTest::DisabledRestApiTest < Redmine::ApiTest::Base
@token = Token.create!(:user => @user, :action => 'api')
get "/news.xml", :headers => credentials(@token.value, 'X')
assert_response :unauthorized
assert_response :forbidden
assert_equal User.anonymous, User.current
get "/news.json", :headers => credentials(@token.value, 'X')
assert_response :unauthorized
assert_response :forbidden
assert_equal User.anonymous, User.current
end
end