TRKJ/gitea
2
0
Fork 0
mirror of https://gitee.com/gitea/gitea synced 2025-11-04 08:30:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1905 from ethantkoenig/fix/org_api_auth

Browse Source 
Require token before checking membership/ownership
This commit is contained in:
Andrey Nering
2017-06-07 16:49:52 -03:00
committed by GitHub
parent a70073e768 971e3a35c1
commit 65cf6cc848
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
routers/api/v1/api.go
View File

@@ -453,19 +453,19 @@ func RegisterRoutes(m *macaron.Macaron) {
m.Get("/users/:username/orgs", org.ListUserOrgs)
m.Group("/orgs/:orgname", func() {
m.Combo("").Get(org.Get).
Patch(reqOrgOwnership(), bind(api.EditOrgOption{}), org.Edit)
Patch(reqToken(), reqOrgOwnership(), bind(api.EditOrgOption{}), org.Edit)
m.Group("/members", func() {
m.Get("", org.ListMembers)
m.Combo("/:username").Get(org.IsMember).
Delete(reqOrgOwnership(), org.DeleteMember)
Delete(reqToken(), reqOrgOwnership(), org.DeleteMember)
})
m.Group("/public_members", func() {
m.Get("", org.ListPublicMembers)
m.Combo("/:username").Get(org.IsPublicMember).
Put(reqOrgMembership(), org.PublicizeMember).
Delete(reqOrgMembership(), org.ConcealMember)
Put(reqToken(), reqOrgMembership(), org.PublicizeMember).
Delete(reqToken(), reqOrgMembership(), org.ConcealMember)
})
m.Combo("/teams", reqOrgMembership()).Get(org.ListTeams).
m.Combo("/teams", reqToken(), reqOrgMembership()).Get(org.ListTeams).
Post(bind(api.CreateTeamOption{}), org.CreateTeam)
m.Group("/hooks", func() {
m.Combo("").Get(org.ListHooks).
@@ -473,7 +473,7 @@ func RegisterRoutes(m *macaron.Macaron) {
m.Combo("/:id").Get(org.GetHook).
Patch(reqOrgOwnership(), bind(api.EditHookOption{}), org.EditHook).
Delete(reqOrgOwnership(), org.DeleteHook)
}, reqOrgMembership())
}, reqToken(), reqOrgMembership())
}, orgAssignment(true))
m.Group("/teams/:teamid", func() {
m.Combo("").Get(org.GetTeam).
@@ -491,7 +491,7 @@ func RegisterRoutes(m *macaron.Macaron) {
Put(org.AddTeamRepository).
Delete(org.RemoveTeamRepository)
})
}, orgAssignment(false, true), reqOrgMembership())
}, orgAssignment(false, true), reqToken(), reqOrgMembership())
m.Any("/*", func(ctx *context.Context) {
ctx.Error(404)