Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Remove API authentication for public statuses (after review) (#1919)

Browse source
This commit is contained in:
happycoloredbanana 2017-04-18 22:58:57 +03:00 • committed by Eugen
parent 3ed219f907
commit 0a7588282a
2 changed files with 268 additions and 153 deletions
Download patch file Download diff file Expand all files Collapse all files

7
app/controllers/api/v1/statuses_controller.rb
View file

@ -1,7 +1,7 @@
# frozen_string_literal: true
class Api::V1::StatusesController < ApiController
before_action -> { doorkeeper_authorize! :read }, except: [:create, :destroy, :reblog, :unreblog, :favourite, :unfavourite]
before_action :authorize_if_got_token, except: [:create, :destroy, :reblog, :unreblog, :favourite, :unfavourite]
before_action -> { doorkeeper_authorize! :write }, only: [:create, :destroy, :reblog, :unreblog, :favourite, :unfavourite]
before_action :require_user!, except: [:show, :context, :card, :reblogged_by, :favourited_by]
before_action :set_status, only: [:show, :context, :card, :reblogged_by, :favourited_by]
@ -114,4 +114,9 @@ class Api::V1::StatusesController < ApiController
def pagination_params(core_params)
params.permit(:limit).merge(core_params)
end
def authorize_if_got_token
request_token = Doorkeeper::OAuth::Token.from_request(request, *Doorkeeper.configuration.access_token_methods)
doorkeeper_authorize! :read if request_token
end
end