#1128: API calls are not hidden behind sign in

modules/auth/auth.go

@@ -21,6 +21,10 @@ import (
 	"github.com/gogits/gogs/modules/uuid"
 )
 
+func IsAPIPath(url string) bool {
+	return strings.HasPrefix(url, "/api/")
+}
+
 // SignedInId returns the id of signed in user.
 func SignedInId(req *http.Request, sess session.Store) int64 {
 	if !models.HasEngine {
@@ -28,7 +32,7 @@ func SignedInId(req *http.Request, sess session.Store) int64 {
 	}
 
 	// API calls need to check access token.
-	if strings.HasPrefix(req.URL.Path, "/api/") {
+	if IsAPIPath(req.URL.Path) {
 		auHead := req.Header.Get("Authorization")
 		if len(auHead) > 0 {
 			auths := strings.Fields(auHead)

modules/middleware/auth.go

@@ -10,6 +10,7 @@ import (
 	"github.com/Unknwon/macaron"
 	"github.com/macaron-contrib/csrf"
 
+	"github.com/gogits/gogs/modules/auth"
 	"github.com/gogits/gogs/modules/setting"
 )
 
@@ -49,6 +50,12 @@ func Toggle(options *ToggleOptions) macaron.Handler {
 
 		if options.SignInRequire {
 			if !ctx.IsSigned {
+				// Restrict API calls with error message.
+				if auth.IsAPIPath(ctx.Req.URL.Path) {
+					ctx.HandleAPI(403, "Only signed in user is allowed to call APIs.")
+					return
+				}
+
 				ctx.SetCookie("redirect_to", url.QueryEscape(setting.AppSubUrl+ctx.Req.RequestURI), 0, setting.AppSubUrl)
 				ctx.Redirect(setting.AppSubUrl + "/user/login")
 				return