diff options
Diffstat (limited to 'routers/api')
| -rw-r--r-- | routers/api/v1/api.go | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index b12cb1374a..a839ce8dc1 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -174,11 +174,15 @@ func repoAssignment() macaron.Handler { // Contexter middleware already checks token for user sign in process. func reqToken() macaron.Handler { - return func(ctx *context.Context) { - if true != ctx.Data["IsApiToken"] { - ctx.Error(401) + return func(ctx *context.APIContext) { + if true == ctx.Data["IsApiToken"] { + return + } + if ctx.IsSigned { + ctx.RequireCSRF() return } + ctx.Context.Error(401) } } @@ -635,7 +639,7 @@ func RegisterRoutes(m *macaron.Macaron) { m.Post("/repos", bind(api.CreateRepoOption{}), admin.CreateRepo) }) }) - }, reqAdmin()) + }, reqToken(), reqAdmin()) m.Group("/topics", func() { m.Get("/search", repo.TopicSearch) |