diff --git a/cmd/web.go b/cmd/web.go index ca4a6291b..db1bf98af 100644 --- a/cmd/web.go +++ b/cmd/web.go @@ -242,7 +242,7 @@ func runWeb(ctx *cli.Context) { ctx.HandleAPI(404, "Page not found") }) }) - }) + }, ignSignIn) // User. m.Group("/user", func() { diff --git a/conf/locale/TRANSLATORS b/conf/locale/TRANSLATORS index 1c2768afd..733c4ef43 100644 --- a/conf/locale/TRANSLATORS +++ b/conf/locale/TRANSLATORS @@ -8,6 +8,7 @@ Huimin Wang Thomas Fanninger Ɓukasz Jan Niemier Lafriks +Luc Stepniewski Miguel de la Cruz Natan Albuquerque Marc Schiller diff --git a/gogs.go b/gogs.go index 958792e0d..1fe0153e6 100644 --- a/gogs.go +++ b/gogs.go @@ -17,7 +17,7 @@ import ( "github.com/gogits/gogs/modules/setting" ) -const APP_VER = "0.6.1.0714 Beta" +const APP_VER = "0.6.1.0715 Beta" func init() { runtime.GOMAXPROCS(runtime.NumCPU()) diff --git a/modules/auth/auth.go b/modules/auth/auth.go index edcb13069..423464302 100644 --- a/modules/auth/auth.go +++ b/modules/auth/auth.go @@ -21,6 +21,10 @@ import ( "github.com/gogits/gogs/modules/uuid" ) +func IsAPIPath(url string) bool { + return strings.HasPrefix(url, "/api/") +} + // SignedInId returns the id of signed in user. func SignedInId(req *http.Request, sess session.Store) int64 { if !models.HasEngine { @@ -28,7 +32,7 @@ func SignedInId(req *http.Request, sess session.Store) int64 { } // API calls need to check access token. - if strings.HasPrefix(req.URL.Path, "/api/") { + if IsAPIPath(req.URL.Path) { auHead := req.Header.Get("Authorization") if len(auHead) > 0 { auths := strings.Fields(auHead) diff --git a/modules/middleware/auth.go b/modules/middleware/auth.go index 8f86b7917..2a02d2760 100644 --- a/modules/middleware/auth.go +++ b/modules/middleware/auth.go @@ -10,6 +10,7 @@ import ( "github.com/Unknwon/macaron" "github.com/macaron-contrib/csrf" + "github.com/gogits/gogs/modules/auth" "github.com/gogits/gogs/modules/setting" ) @@ -49,6 +50,12 @@ func Toggle(options *ToggleOptions) macaron.Handler { if options.SignInRequire { if !ctx.IsSigned { + // Restrict API calls with error message. + if auth.IsAPIPath(ctx.Req.URL.Path) { + ctx.HandleAPI(403, "Only signed in user is allowed to call APIs.") + return + } + ctx.SetCookie("redirect_to", url.QueryEscape(setting.AppSubUrl+ctx.Req.RequestURI), 0, setting.AppSubUrl) ctx.Redirect(setting.AppSubUrl + "/user/login") return diff --git a/templates/.VERSION b/templates/.VERSION index 627dda90e..815ab4178 100644 --- a/templates/.VERSION +++ b/templates/.VERSION @@ -1 +1 @@ -0.6.1.0714 Beta \ No newline at end of file +0.6.1.0715 Beta \ No newline at end of file