Enforce token on api routes [fixed critical security issue #4357] (#4840)

2018-09-11 02:15:52 +10:00 · 2018-09-11 02:15:52 +10:00 · e47df0b301
commit e47df0b301
parent 387a4b09c1
17 changed files with 131 additions and 89 deletions
--- a/modules/auth/auth.go
+++ b/modules/auth/auth.go
@ -63,6 +63,7 @@ func SignedInID(ctx *macaron.Context, sess session.Store) int64 {
 			if err = models.UpdateAccessToken(t); err != nil {
 				log.Error(4, "UpdateAccessToken: %v", err)
 			}
+			ctx.Data["IsApiToken"] = true
 			return t.UID
 		}
 	}
@ -136,7 +137,7 @@ func SignedInUser(ctx *macaron.Context, sess session.Store) (*models.User, bool)
 				}
 				return nil, false
 			}
-
+			ctx.Data["IsApiToken"] = true
 			return u, true
 		}
 	}