cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prevent API tokens without write_notes creating attributed comments

Browse source 
Fixes #4362
This commit is contained in:
Tom Hughes 2023-11-22 12:30:39 +00:00
parent 5da286bb45
commit f08fb4f30f
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
app/controllers/api/notes_controller.rb
View file

@ -389,8 +389,14 @@ module Api
def add_comment(note, text, event, notify: true) def add_comment(note, text, event, notify: true)
attributes = { :visible => true, :event => event, :body => text } attributes = { :visible => true, :event => event, :body => text }
if current_user if doorkeeper_token || current_token
attributes[:author_id] = current_user.id author = current_user if scope_enabled?(:write_notes)
else
author = current_user
end
if author
attributes[:author_id] = author.id
else else
attributes[:author_ip] = request.remote_ip attributes[:author_ip] = request.remote_ip
end end