X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/14936150ac8ab5cb4e8347b772b2c966f2add43f..1cf4bf5d983c65ac0bb3868f0bd962b016433265:/app/controllers/api_controller.rb diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index 89388c0bb..edafac7cc 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -106,19 +106,27 @@ class ApiController < ApplicationController if doorkeeper_token&.accessible? self.current_user = User.find(doorkeeper_token.resource_owner_id) elsif Authenticator.new(self, [:token]).allow? - # self.current_user setup by OAuth - elsif Settings.basic_auth_support + if Settings.oauth_10a_support + # self.current_user setup by OAuth + else + report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden + end + else username, passwd = auth_data # parse from headers # authenticate per-scheme self.current_user = if username.nil? nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == "token" - User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth else User.authenticate(:username => username, :password => passwd) # basic auth end - # log if we have authenticated using basic auth - logger.info "Authenticated as user #{current_user.id} using basic authentication" if current_user + if username && current_user + if Settings.basic_auth_support + # log if we have authenticated using basic auth + logger.info "Authenticated as user #{current_user.id} using basic authentication" + else + report_error t("application.basic_auth_disabled", :link => t("application.auth_disabled_link")), :forbidden + end + end end # have we identified the user? @@ -166,18 +174,10 @@ class ApiController < ApplicationController report_error "#{e.class}: #{e.message}", :internal_server_error end - ## - # asserts that the request method is the +method+ given as a parameter - # or raises a suitable error. +method+ should be a symbol, e.g: :put or :get. - def assert_method(method) - ok = request.send(:"#{method.to_s.downcase}?") - raise OSM::APIBadMethodError, method unless ok - end - ## # wrap an api call in a timeout def api_call_timeout(&block) - Timeout.timeout(Settings.api_timeout, Timeout::Error, &block) + Timeout.timeout(Settings.api_timeout, &block) rescue ActionView::Template::Error => e e = e.cause @@ -192,4 +192,14 @@ class ApiController < ApplicationController ActiveRecord::Base.connection.raw_connection.cancel raise OSM::APITimeoutError end + + ## + # check the api change rate limit + def check_rate_limit(new_changes = 1) + max_changes = ActiveRecord::Base.connection.select_value( + "SELECT api_rate_limit($1)", "api_rate_limit", [current_user.id] + ) + + raise OSM::APIRateLimitExceeded if new_changes > max_changes + end end