Merge pull request #4496 from tomhughes/disabled-auth-error

Return an error when a disabled authentication mechanism is used

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index e4e156ee85a78fd2b6b23cf29e27bbf5910ddb85..edafac7ccdc44f3f75f07e0f3a082909a793bfea 100644 (file)
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -106,8 +106,12 @@ class ApiController < ApplicationController
     if doorkeeper_token&.accessible?
       self.current_user = User.find(doorkeeper_token.resource_owner_id)
     elsif Authenticator.new(self, [:token]).allow?
-      # self.current_user setup by OAuth
-    elsif Settings.basic_auth_support
+      if Settings.oauth_10a_support
+        # self.current_user setup by OAuth
+      else
+        report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden
+      end
+    else
       username, passwd = auth_data # parse from headers
       # authenticate per-scheme
       self.current_user = if username.nil?
@@ -115,8 +119,14 @@ class ApiController < ApplicationController
                           else
                             User.authenticate(:username => username, :password => passwd) # basic auth
                           end
-      # log if we have authenticated using basic auth
-      logger.info "Authenticated as user #{current_user.id} using basic authentication" if current_user
+      if username && current_user
+        if Settings.basic_auth_support
+          # log if we have authenticated using basic auth
+          logger.info "Authenticated as user #{current_user.id} using basic authentication"
+        else
+          report_error t("application.basic_auth_disabled", :link => t("application.auth_disabled_link")), :forbidden
+        end
+      end
     end
 
     # have we identified the user?

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 488e6a8189cbb41c5b389f34cb9c8b48c8777783..5d69a5fc8c1fb54c16f7b382b059096bce4122ad 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -67,6 +67,10 @@ class ApplicationController < ActionController::Base
     @oauth_token = current_user.oauth_token(Settings.oauth_application) if current_user && Settings.key?(:oauth_application)
   end
 
+  def require_oauth_10a_support
+    report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden unless Settings.oauth_10a_support
+  end
+
   ##
   # require the user to have cookies enabled in their browser
   def require_cookies

diff --git a/app/controllers/oauth_controller.rb b/app/controllers/oauth_controller.rb
index cd7e48277a2517b23e49af4cdb31eddfd396a762..49af05b0d188e814960468d0a0f335cfd989f62e 100644 (file)
--- a/app/controllers/oauth_controller.rb
+++ b/app/controllers/oauth_controller.rb
@@ -5,6 +5,8 @@ class OauthController < ApplicationController
   # a login, but we want to check authorization on every action.
   authorize_resource :class => false
 
+  before_action :require_oauth_10a_support
+
   layout "site"
 
   def revoke

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 774be22d43d9bc530576927814cabd4dc9ae7726..fdd3077ac2403ef01b462b3b16bd808021f18e28 100644 (file)
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2557,6 +2557,9 @@ en:
         other: "GPX file with %{count} points from %{user}"
       description_without_count: "GPX file from %{user}"
   application:
+    basic_auth_disabled: "HTTP Basic Authentication is disabled: %{link}"
+    oauth_10a_disabled: "OAuth 1.0 and 1.0a are disabled: %{link}"
+    auth_disabled_link: "https://wiki.openstreetmap.org/wiki/2024_authentication_update"
     permission_denied: You do not have permission to access that action
     require_cookies:
       cookies_needed: "You appear to have cookies disabled - please enable cookies in your browser before continuing."

diff --git a/config/settings.yml b/config/settings.yml
index c057be978a841485174d6714ea3499744011fd2e..ec868b651baa84d729f5305c3bcb859e4ac6899f 100644 (file)
--- a/config/settings.yml
+++ b/config/settings.yml
@@ -97,9 +97,12 @@ attachments_dir: ":rails_root/public/attachments"
 #memcache_servers: []
 # Enable HTTP basic authentication support
 basic_auth_support: true
+# Enable OAuth 1.0/1.0a registration
+oauth_10_registration: true
 # Enable legacy OAuth 1.0 support
 oauth_10_support: true
-oauth_10_registration: true
+# Enable OAuth 1.0a support
+oauth_10a_support: true
 # URL of Nominatim instance to use for geocoding
 nominatim_url: "https://nominatim.openstreetmap.org/"
 # Default editor