X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/93da9596997444baa576e296e371065a3cb99eb3..159ef16601b7b7157ce9d766db97c4189d145e42:/app/controllers/api_controller.rb diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index 64514a432..a8067a493 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -4,52 +4,44 @@ class ApiController < ApplicationController private ## - # Set default request format to xml unless a client requests a specific format, - # which can be done via (a) URL suffix and/or (b) HTTP Accept header, where - # the URL suffix always takes precedence over the Accept header. - def set_default_request_format + # Set allowed request formats if no explicit format has been + # requested via a URL suffix. Allowed formats are taken from + # any HTTP Accept header with XML as the default. + def set_request_formats unless params[:format] accept_header = request.headers["HTTP_ACCEPT"] - if accept_header.nil? - # e.g. unit tests don't set an Accept: header by default, force XML in this case - request.format = "xml" - return - end - - req_mimetypes = [] - - # Some clients (JOSM) send Accept headers which cannot be parsed by Rails, example: *; q=.2 - # To be fair, JOSM's Accept header doesn't adhere to RFC 7231, section 5.3.1, et al. either - # As a workaround for backwards compatibility, we're assuming XML format - begin - req_mimetypes = Mime::Type.parse(accept_header) - rescue Mime::Type::InvalidMimeType - request.format = "xml" - return - end - # req_mimetypes contains all Accept header MIME types with descending priority - req_mimetypes.each do |mime| - if mime.symbol == :xml - request.format = "xml" - break + if accept_header + # Some clients (such asJOSM) send Accept headers which cannot be + # parse by Rails, for example: + # + # Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 + # + # where both "*" and ".2" as a quality do not adhere to the syntax + # described in RFC 7231, section 5.3.1, etc. + # + # As a workaround, and for back compatibility, default to XML format. + mimetypes = begin + Mime::Type.parse(accept_header) + rescue Mime::Type::InvalidMimeType + Array(Mime[:xml]) end - if mime.symbol == :json - request.format = "json" - break + # Allow XML and JSON formats, and treat an all formats wildcard + # as XML for backwards compatibility - all other formats are discarded + # which will result in a 406 Not Acceptable response being sent + formats = mimetypes.map do |mime| + if mime.symbol == :xml || mime == "*/*" then :xml + elsif mime.symbol == :json then :json + end end - - # Any format, not explicitly requesting XML or JSON -> assume XML as default - if mime == "*/*" - request.format = "xml" - break - end - - # In case the client requests some other format besides XML, JSON and */*, - # we deliberately don't set request.format. The framework will return an - # ActionController::UnknownFormat error to the client later on in this case. + else + # Default to XML if no accept header was sent - this includes + # the unit tests which don't set one by default + formats = Array(:xml) end + + request.formats = formats.compact end end @@ -60,15 +52,22 @@ class ApiController < ApplicationController # handle authenticate pass/fail unless current_user # no auth, the user does not exist or the password was wrong - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized + if Settings.basic_auth_support + response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" + render :plain => errormessage, :status => :unauthorized + else + render :plain => errormessage, :status => :forbidden + end + false end end def current_ability # Use capabilities from the oauth token if it exists and is a valid access token - if Authenticator.new(self, [:token]).allow? + if doorkeeper_token&.accessible? + ApiAbility.new(nil).merge(ApiCapability.new(doorkeeper_token)) + elsif Authenticator.new(self, [:token]).allow? ApiAbility.new(nil).merge(ApiCapability.new(current_token)) else ApiAbility.new(current_user) @@ -76,16 +75,18 @@ class ApiController < ApplicationController end def deny_access(_exception) - if current_token + if doorkeeper_token || current_token set_locale report_error t("oauth.permissions.missing"), :forbidden elsif current_user head :forbidden - else + elsif Settings.basic_auth_support realm = "Web Password" errormessage = "Couldn't authenticate you" response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" render :plain => errormessage, :status => :unauthorized + else + render :plain => errormessage, :status => :forbidden end end @@ -100,9 +101,14 @@ class ApiController < ApplicationController # from the authorize method, but can be called elsewhere if authorisation # is optional. def setup_user_auth + logger.info " setup_user_auth" # try and setup using OAuth - unless Authenticator.new(self, [:token]).allow? - username, passwd = get_auth_data # parse from headers + if doorkeeper_token&.accessible? + self.current_user = User.find(doorkeeper_token.resource_owner_id) + elsif Authenticator.new(self, [:token]).allow? + # self.current_user setup by OAuth + elsif Settings.basic_auth_support + username, passwd = auth_data # parse from headers # authenticate per-scheme self.current_user = if username.nil? nil # no authentication provided - perhaps first connect (client should retry after 401) @@ -111,6 +117,8 @@ class ApiController < ApplicationController else User.authenticate(:username => username, :password => passwd) # basic auth end + # log if we have authenticated using basic auth + logger.info "Authenticated as user #{current_user.id} using basic authentication" if current_user end # have we identified the user?