diff options
| author | Ethan Koenig <ethantkoenig@gmail.com> | 2017-06-07 12:20:32 -0400 |
|---|---|---|
| committer | Ethan Koenig <ethantkoenig@gmail.com> | 2017-06-07 12:20:32 -0400 |
| commit | 971e3a35c12da4c31060ad4a652901f9953dcf63 (patch) | |
| tree | 1eace9227e648738f5b01b0856d045065d1fe733 /routers | |
| parent | d9a8eff2def111d1b038cbceea0a6b3ed7d43300 (diff) | |
| download | gitea-971e3a35c12da4c31060ad4a652901f9953dcf63.tar.gz gitea-971e3a35c12da4c31060ad4a652901f9953dcf63.zip | |
Require token before checking membership/ownership
Diffstat (limited to 'routers')
| -rw-r--r-- | routers/api/v1/api.go | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index 9ff71ed2f2..2c09c11897 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -453,19 +453,19 @@ func RegisterRoutes(m *macaron.Macaron) { m.Get("/users/:username/orgs", org.ListUserOrgs) m.Group("/orgs/:orgname", func() { m.Combo("").Get(org.Get). - Patch(reqOrgOwnership(), bind(api.EditOrgOption{}), org.Edit) + Patch(reqToken(), reqOrgOwnership(), bind(api.EditOrgOption{}), org.Edit) m.Group("/members", func() { m.Get("", org.ListMembers) m.Combo("/:username").Get(org.IsMember). - Delete(reqOrgOwnership(), org.DeleteMember) + Delete(reqToken(), reqOrgOwnership(), org.DeleteMember) }) m.Group("/public_members", func() { m.Get("", org.ListPublicMembers) m.Combo("/:username").Get(org.IsPublicMember). - Put(reqOrgMembership(), org.PublicizeMember). - Delete(reqOrgMembership(), org.ConcealMember) + Put(reqToken(), reqOrgMembership(), org.PublicizeMember). + Delete(reqToken(), reqOrgMembership(), org.ConcealMember) }) - m.Combo("/teams", reqOrgMembership()).Get(org.ListTeams). + m.Combo("/teams", reqToken(), reqOrgMembership()).Get(org.ListTeams). Post(bind(api.CreateTeamOption{}), org.CreateTeam) m.Group("/hooks", func() { m.Combo("").Get(org.ListHooks). @@ -473,7 +473,7 @@ func RegisterRoutes(m *macaron.Macaron) { m.Combo("/:id").Get(org.GetHook). Patch(reqOrgOwnership(), bind(api.EditHookOption{}), org.EditHook). Delete(reqOrgOwnership(), org.DeleteHook) - }, reqOrgMembership()) + }, reqToken(), reqOrgMembership()) }, orgAssignment(true)) m.Group("/teams/:teamid", func() { m.Combo("").Get(org.GetTeam). @@ -491,7 +491,7 @@ func RegisterRoutes(m *macaron.Macaron) { Put(org.AddTeamRepository). Delete(org.RemoveTeamRepository) }) - }, orgAssignment(false, true), reqOrgMembership()) + }, orgAssignment(false, true), reqToken(), reqOrgMembership()) m.Any("/*", func(ctx *context.Context) { ctx.Error(404) |