Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-20 22:42:53 -05:00
Code Issues Activity

🐛 Fixed v0.1 username/password authentication

Browse source 
no issue

- refs 39edb7646e
This commit is contained in:
kirrg001 2019-03-06 10:38:16 +01:00
parent 5b73e8238e
commit ac26436c10
3 changed files with 9 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
core/server/services/auth/authenticate.js
View file

@ -5,7 +5,6 @@ const common = require('../../lib/common');
const session = require('./session');
const apiKeyAuth = require('./api-key');
const members = require('./members');
const labs = require('../labs');
const authenticate = {
// ### Authenticate Client Middleware
@ -39,14 +38,6 @@ const authenticate = {
req.body.client_secret = req.query.client_secret;
}
if (labs.isSet('publicAPI') !== true) {
return next(new common.errors.NoPermissionError({
message: common.i18n.t('errors.middleware.auth.publicAPIDisabled.error'),
context: common.i18n.t('errors.middleware.auth.publicAPIDisabled.context'),
help: common.i18n.t('errors.middleware.auth.forInformationRead', {url: 'https://docs.ghost.org/api/content/'})
}));
}
if (!req.body.client_id || !req.body.client_secret) {
return next(new common.errors.UnauthorizedError({
message: common.i18n.t('errors.middleware.auth.accessDenied'),

9
core/server/services/auth/authorize.js
View file

@ -22,6 +22,15 @@ const authorize = {
if (req.user && req.user.id) {
return next();
} else {
// CASE: has no user access and public api is disabled
if (labs.isSet('publicAPI') !== true) {
return next(new common.errors.NoPermissionError({
message: common.i18n.t('errors.middleware.auth.publicAPIDisabled.error'),
context: common.i18n.t('errors.middleware.auth.publicAPIDisabled.context'),
help: common.i18n.t('errors.middleware.auth.forInformationRead', {url: 'https://docs.ghost.org/api/content/'})
}));
}
return next(new common.errors.NoPermissionError({
message: common.i18n.t('errors.middleware.auth.pleaseSignIn')
}));

19
core/test/unit/services/auth/authenticate_spec.js
View file

@ -349,25 +349,6 @@ describe('Auth', function () {
done();
});
it('shouldn\'t authenticate when publicAPI is disabled', function (done) {
labs.isSet.restore();
sinon.stub(labs, 'isSet').withArgs('publicAPI').returns(false);
req.body = {};
req.body.client_id = testClient;
req.body.client_secret = testSecret;
req.headers = {};
var next = function next(err) {
err.statusCode.should.eql(403);
(err instanceof common.errors.NoPermissionError).should.eql(true);
done();
};
registerSuccessfulClientPasswordStrategy();
auth.authenticate.authenticateClient(req, res, next);
});
it('shouldn\'t authenticate when error', function (done) {
req.body = {};
req.body.client_id = testClient;