Enforce token on api routes [fixed critical security issue #4357] (#4840)

2018-09-11 02:15:52 +10:00 · 2018-09-11 02:15:52 +10:00 · e47df0b301
commit e47df0b301
parent 387a4b09c1
17 changed files with 131 additions and 89 deletions
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@ -175,7 +175,7 @@ func repoAssignment() macaron.Handler {
 // Contexter middleware already checks token for user sign in process.
 func reqToken() macaron.Handler {
 	return func(ctx *context.Context) {
-		if !ctx.IsSigned {
+		if true != ctx.Data["IsApiToken"] {
 			ctx.Error(401)
 			return
 		}