paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-06 06:53:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "rest: Simplify authentication error handling."

Browse Source 
This reverts commit 1f90a31fa3.
This commit is contained in:
Tim Abbott
2020-08-25 17:41:16 -07:00
parent 34b420bf59
commit fd3a43b51e
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
zerver/lib/rest.py
View File

@@ -140,15 +140,18 @@ def rest_dispatch(request: HttpRequest, **kwargs: Any) -> HttpResponse:
target_function = authenticated_rest_api_view( target_function = authenticated_rest_api_view(
is_webhook='allow_incoming_webhooks' in view_flags, is_webhook='allow_incoming_webhooks' in view_flags,
)(target_function) )(target_function)
elif request.path.startswith("/json") and 'allow_anonymous_user_web' in view_flags: # Pick a way to tell user they're not authed based on how the request was made
# For endpoints that support anonymous web access, we do that. else:
# Logged out user accessing an endpoint with anonymous user access on JSON; proceed.
# `allow_anonymous_user_web` calls are only restricted to /json calls used
# by our webapp.
# TODO: Allow /api calls when this is stable enough. # TODO: Allow /api calls when this is stable enough.
if request.path.startswith("/json") and 'allow_anonymous_user_web' in view_flags:
auth_kwargs = dict(allow_unauthenticated=True) auth_kwargs = dict(allow_unauthenticated=True)
target_function = csrf_protect(authenticated_json_view( target_function = csrf_protect(authenticated_json_view(
target_function, **auth_kwargs)) target_function, **auth_kwargs))
else: else:
# Otherwise, throw an authentication error; our middleware # Don't allow anonymous queries to endpoints witout `allow_anonymous_user_web` flag.
# will generate the appropriate HTTP response.
raise MissingAuthenticationError() raise MissingAuthenticationError()
if request.method not in ["GET", "POST"]: if request.method not in ["GET", "POST"]: