worldcone/forgejo
2
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Allow token as authorization for accessing attachments (#7909)

Browse source 
* Allow token as authorization for accessing attachments

Signed-off-by: David Svantesson <davidsvantesson@gmail.com>

* Only allow token authentication for attachments if it is a download (GET)
This commit is contained in:
David Svantesson 2019-08-24 02:33:32 +02:00 committed by Antoine GIRARD
parent 70d2244e49
commit ce45a8c257
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
modules/auth/auth.go
View file

@ -29,6 +29,11 @@ func IsAPIPath(url string) bool {
return strings.HasPrefix(url, "/api/") return strings.HasPrefix(url, "/api/")
} }
// IsAttachmentDownload check if request is a file download (GET) with URL to an attachment
func IsAttachmentDownload(ctx *macaron.Context) bool {
return strings.HasPrefix(ctx.Req.URL.Path, "/attachments/") && ctx.Req.Method == "GET"
}
// SignedInID returns the id of signed in user. // SignedInID returns the id of signed in user.
func SignedInID(ctx *macaron.Context, sess session.Store) int64 { func SignedInID(ctx *macaron.Context, sess session.Store) int64 {
if !models.HasEngine { if !models.HasEngine {
@ -36,7 +41,7 @@ func SignedInID(ctx *macaron.Context, sess session.Store) int64 {
} }
// Check access token. // Check access token.
if IsAPIPath(ctx.Req.URL.Path) { if IsAPIPath(ctx.Req.URL.Path) || IsAttachmentDownload(ctx) {
tokenSHA := ctx.Query("token") tokenSHA := ctx.Query("token")
if len(tokenSHA) == 0 { if len(tokenSHA) == 0 {
tokenSHA = ctx.Query("access_token") tokenSHA = ctx.Query("access_token")