From: Tom Hughes <tom@compton.nu>
Date: Sun, 7 Jul 2024 18:40:28 +0000 (+0100)
Subject: Clear current_user if we reject OAuth 1
X-Git-Tag: live~420
X-Git-Url: https://git.openstreetmap.org./rails.git/commitdiff_plain/3e77cae66c99a2cf3e29356a64cd230343d9762f

Clear current_user if we reject OAuth 1

This ensures we don't try and do any further validation of the
user which might lead to trying to report additional errors.
---

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index ff7f694c5..ae1bc8755 100644
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -112,6 +112,7 @@ class ApiController < ApplicationController
         # self.current_user setup by OAuth
       else
         report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden
+        self.current_user = nil
       end
     else
       username, passwd = auth_data # parse from headers