742291a840
Now that we have all api controllers inheriting from a common base, it's easier to override the deny_access handler without having to switch between both. Fixes #2064
17 lines
507 B
Ruby
17 lines
507 B
Ruby
class ApiController < ApplicationController
|
|
skip_before_action :verify_authenticity_token
|
|
|
|
def deny_access(_exception)
|
|
if current_token
|
|
set_locale
|
|
report_error t("oauth.permissions.missing"), :forbidden
|
|
elsif current_user
|
|
head :forbidden
|
|
else
|
|
realm = "Web Password"
|
|
errormessage = "Couldn't authenticate you"
|
|
response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
|
|
render :plain => errormessage, :status => :unauthorized
|
|
end
|
|
end
|
|
end
|