X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/6290405336817cd282ad5062ce3fc3774ccf61e4..257ecde90d81a23b9cfcd2376ee39374b8fa2e7b:/app/controllers/api_controller.rb?ds=sidebyside

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index e4e156ee8..ae1bc8755 100644
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -1,6 +1,8 @@
 class ApiController < ApplicationController
   skip_before_action :verify_authenticity_token
 
+  before_action :check_api_readable
+
   private
 
   ##
@@ -106,8 +108,13 @@ class ApiController < ApplicationController
     if doorkeeper_token&.accessible?
       self.current_user = User.find(doorkeeper_token.resource_owner_id)
     elsif Authenticator.new(self, [:token]).allow?
-      # self.current_user setup by OAuth
-    elsif Settings.basic_auth_support
+      if Settings.oauth_10a_support
+        # self.current_user setup by OAuth
+      else
+        report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden
+        self.current_user = nil
+      end
+    else
       username, passwd = auth_data # parse from headers
       # authenticate per-scheme
       self.current_user = if username.nil?
@@ -115,8 +122,14 @@ class ApiController < ApplicationController
                           else
                             User.authenticate(:username => username, :password => passwd) # basic auth
                           end
-      # log if we have authenticated using basic auth
-      logger.info "Authenticated as user #{current_user.id} using basic authentication" if current_user
+      if username && current_user
+        if Settings.basic_auth_support
+          # log if we have authenticated using basic auth
+          logger.info "Authenticated as user #{current_user.id} using basic authentication"
+        else
+          report_error t("application.basic_auth_disabled", :link => t("application.auth_disabled_link")), :forbidden
+        end
+      end
     end
 
     # have we identified the user?