github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-26 02:23:37 +08:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

FIX: Allowed URLs for API scopes added by plugins (#15662)

Browse Source
This commit is contained in:
Osama Sayegh 2022-01-20 22:29:03 +03:00 committed by GitHub
parent 2dc0f36e07
commit 688be607c9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/models/api_key_scope.rb
View File

@ -101,7 +101,14 @@ class ApiKeyScope < ActiveRecord::Base
urls = []
if actions.present?
Rails.application.routes.routes.each do |route|
routes = Rails.application.routes.routes.to_a
Rails::Engine.descendants.each do |engine|
next if engine == Rails::Application # abstract engine, can't call routes on it
next if engine == Discourse::Application # equiv. to Rails.application
routes.concat(engine.routes.routes.to_a)
end
routes.each do |route|
defaults = route.defaults
action = "#{defaults[:controller].to_s}##{defaults[:action]}"
path = route.path.spec.to_s.gsub(/\(\.:format\)/, '')