Check user instead of scope when getting note author info
Previously it was possible to create a note while authorized but having no write_notes scope. Currently it's not possible.
This commit is contained in:
parent
f5af8befa9
commit
037bafcd1c
1 changed files with 1 additions and 1 deletions
|
@ -387,7 +387,7 @@ module Api
|
|||
##
|
||||
# Get author's information (for logged in users - user_id, for logged out users - IP address)
|
||||
def author_info
|
||||
if scope_enabled?(:write_notes)
|
||||
if current_user
|
||||
{ :user_id => current_user.id }
|
||||
else
|
||||
{ :user_ip => request.remote_ip }
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue