github-mirror/framework
2
0
Fork 0
mirror of https://github.com/flarum/framework.git synced 2024-12-11 21:43:38 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Always grant master API keys sudo mode

Browse Source
This commit is contained in:
Toby Zerner 2015-12-30 15:26:07 +10:30
parent 2f3abb9cae
commit fc168ef675
3 changed files with 5 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
framework/core/src/Api/ApiKey.php
View File

@ -42,15 +42,4 @@ class ApiKey extends AbstractModel
return $key;
}
/**
* Get the given key only if it is valid.
*
* @param string $key
* @return static|null
*/
public static function valid($key)
{
return static::where('id', $key)->first();
}
}

2
framework/core/src/Core/Access/AssertPermissionTrait.php
View File

@ -75,7 +75,7 @@ trait AssertPermissionTrait
{
$session = $request->getAttribute('session');
if (! $session || $session->get('sudo_expiry') < new DateTime) {
if ($session && $session->get('sudo_expiry') < new DateTime) {
throw new InvalidAccessTokenException;
}
}

5
framework/core/src/Http/Middleware/AuthenticateWithHeader.php
View File

@ -10,6 +10,7 @@
namespace Flarum\Http\Middleware;
use DateTime;
use Flarum\Api\ApiKey;
use Flarum\Core\User;
use Flarum\Http\AccessToken;
@ -36,8 +37,10 @@ class AuthenticateWithHeader implements MiddlewareInterface
if (isset($parts[0]) && starts_with($parts[0], $this->prefix)) {
$id = substr($parts[0], strlen($this->prefix));
if (isset($parts[1]) && ApiKey::valid($id)) {
if (isset($parts[1]) && ApiKey::find($id)) {
$actor = $this->getUser($parts[1]);
$request->getAttribute('session')->set('sudo_expiry', new DateTime);
} elseif ($token = AccessToken::find($id)) {
$token->touch();