Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-06 10:50:21 +08:00
Code Packages Activity Actions 13

FEATURE: allow restricting API keys to a particular range

Browse source
This commit is contained in:
Sam 2014-11-20 15:21:49 +11:00
parent 4aec3c8c4c
commit a9cda0f947
2 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/auth/default_current_user_provider.rb
View file

@ -107,12 +107,16 @@ class Auth::DefaultCurrentUserProvider
api_key = ApiKey.where(key: api_key_value).includes(:user).first
if api_key
api_username = request["api_username"]
if api_key.allowed_ips.present? && !api_key.allowed_ips.any?{|ip| ip.include?(request.ip)}
Rails.logger.warn("Unauthorized API access: #{api_username} ip address: #{request.ip}")
return nil
end
if api_key.user
api_key.user if !api_username || (api_key.user.username_lower == api_username.downcase)
elsif api_username
User.find_by(username_lower: api_username.downcase)
else
nil
end
end
end