From 6ef0a4c4cc4020150393d2a553f1b41d9fe3f38f Mon Sep 17 00:00:00 2001 From: Go MAEDA Date: Wed, 10 Apr 2019 02:51:28 +0000 Subject: [PATCH] Use HTTP status code 403 instead of 401 when REST API is disabled (#30086). Patch by Yuichi HARADA. git-svn-id: http://svn.redmine.org/redmine/trunk@18055 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/application_controller.rb | 9 +++++++-- test/integration/api_test/disabled_rest_api_test.rb | 12 ++++++------ 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index bf660c50b..54f1e63d7 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -231,9 +231,14 @@ class ApplicationController < ActionController::Base format.any(:atom, :pdf, :csv) { redirect_to signin_path(:back_url => url) } - format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' } + format.api { + if Setting.rest_api_enabled? && accept_api_auth? + head(:unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"') + else + head(:forbidden) + end + } format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' } - format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' } format.any { head :unauthorized } end return false diff --git a/test/integration/api_test/disabled_rest_api_test.rb b/test/integration/api_test/disabled_rest_api_test.rb index 9c9f3c387..41bcd7db3 100644 --- a/test/integration/api_test/disabled_rest_api_test.rb +++ b/test/integration/api_test/disabled_rest_api_test.rb @@ -43,11 +43,11 @@ class Redmine::ApiTest::DisabledRestApiTest < Redmine::ApiTest::Base @token = Token.create!(:user => @user, :action => 'api') get "/news.xml?key=#{@token.value}" - assert_response :unauthorized + assert_response :forbidden assert_equal User.anonymous, User.current get "/news.json?key=#{@token.value}" - assert_response :unauthorized + assert_response :forbidden assert_equal User.anonymous, User.current end @@ -57,11 +57,11 @@ class Redmine::ApiTest::DisabledRestApiTest < Redmine::ApiTest::Base end get "/news.xml", :headers => credentials(@user.login, 'my_password') - assert_response :unauthorized + assert_response :forbidden assert_equal User.anonymous, User.current get "/news.json", :headers => credentials(@user.login, 'my_password') - assert_response :unauthorized + assert_response :forbidden assert_equal User.anonymous, User.current end @@ -70,11 +70,11 @@ class Redmine::ApiTest::DisabledRestApiTest < Redmine::ApiTest::Base @token = Token.create!(:user => @user, :action => 'api') get "/news.xml", :headers => credentials(@token.value, 'X') - assert_response :unauthorized + assert_response :forbidden assert_equal User.anonymous, User.current get "/news.json", :headers => credentials(@token.value, 'X') - assert_response :unauthorized + assert_response :forbidden assert_equal User.anonymous, User.current end end -- 2.39.5