From 3e77cae66c99a2cf3e29356a64cd230343d9762f Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Sun, 7 Jul 2024 19:40:28 +0100 Subject: [PATCH] Clear current_user if we reject OAuth 1 This ensures we don't try and do any further validation of the user which might lead to trying to report additional errors. --- app/controllers/api_controller.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index ff7f694c5..ae1bc8755 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -112,6 +112,7 @@ class ApiController < ApplicationController # self.current_user setup by OAuth else report_error t("application.oauth_10a_disabled", :link => t("application.auth_disabled_link")), :forbidden + self.current_user = nil end else username, passwd = auth_data # parse from headers -- 2.39.5