Allow OAuth 1.0a to be disabled

[rails.git] / app / controllers / api_controller.rb

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index af4c0c4f3195d7b11808acf49524b21dd17aa70f..0b45ca16820432f5c025b2441fb380db84eedf32 100644 (file)
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -106,7 +106,11 @@ class ApiController < ApplicationController
     if doorkeeper_token&.accessible?
       self.current_user = User.find(doorkeeper_token.resource_owner_id)
     elsif Authenticator.new(self, [:token]).allow?
-      # self.current_user setup by OAuth
+      if Settings.oauth_10a_support
+        # self.current_user setup by OAuth
+      else
+        report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden
+      end
     else
       username, passwd = auth_data # parse from headers
       # authenticate per-scheme