From: Tom Hughes <tom@compton.nu>
Date: Wed, 7 Feb 2024 19:10:13 +0000 (+0000)
Subject: Return an error when basic authentication is used and is disabled
X-Git-Tag: live~543^2~1
X-Git-Url: https://git.openstreetmap.org./rails.git/commitdiff_plain/1a684a77665f66f42394a86a3bf4e3a8c1431867?hp=4c029873bb3f7cc5774d4a8a68ce3227f00aad97

Return an error when basic authentication is used and is disabled
---

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index 75db7f73b..af4c0c4f3 100644
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -107,7 +107,7 @@ class ApiController < ApplicationController
       self.current_user = User.find(doorkeeper_token.resource_owner_id)
     elsif Authenticator.new(self, [:token]).allow?
       # self.current_user setup by OAuth
-    elsif Settings.basic_auth_support
+    else
       username, passwd = auth_data # parse from headers
       # authenticate per-scheme
       self.current_user = if username.nil?
@@ -117,8 +117,14 @@ class ApiController < ApplicationController
                           else
                             User.authenticate(:username => username, :password => passwd) # basic auth
                           end
-      # log if we have authenticated using basic auth
-      logger.info "Authenticated as user #{current_user.id} using basic authentication" if current_user
+      if username && current_user
+        if Settings.basic_auth_support
+          # log if we have authenticated using basic auth
+          logger.info "Authenticated as user #{current_user.id} using basic authentication"
+        else
+          report_error t("application.basic_auth_disabled", :link => t("application.auth_disabled_link")), :forbidden
+        end
+      end
     end
 
     # have we identified the user?
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 775030638..17cdff9bf 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2555,6 +2555,8 @@ en:
         other: "GPX file with %{count} points from %{user}"
       description_without_count: "GPX file from %{user}"
   application:
+    basic_auth_disabled: "HTTP Basic Authentication is disabled: %{link}"
+    auth_disabled_link: "https://wiki.openstreetmap.org/wiki/2024_authentication_update"
     permission_denied: You do not have permission to access that action
     require_cookies:
       cookies_needed: "You appear to have cookies disabled - please enable cookies in your browser before continuing."