diff options
author | lain <lain@soykaf.club> | 2020-08-28 12:17:19 +0000 |
---|---|---|
committer | lain <lain@soykaf.club> | 2020-08-28 12:17:19 +0000 |
commit | 73dd5bdb7dcdf804bdbabcf632671d4de5042ebc (patch) | |
tree | efcb0b8e68f86d067de98a23f40a24c7dab79d2f /lib/pleroma/web/masto_fe_controller.ex | |
parent | f891e2b2f1d1daa122b9856e4b660be394d31e34 (diff) | |
parent | b141e35d641e733dffe7bd6a45a5bbcafe586c56 (diff) |
Merge branch 'release/2.1.0' into 'stable'v2.1.0
Release/2.1.0
See merge request pleroma/pleroma!2927
Diffstat (limited to 'lib/pleroma/web/masto_fe_controller.ex')
-rw-r--r-- | lib/pleroma/web/masto_fe_controller.ex | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/lib/pleroma/web/masto_fe_controller.ex b/lib/pleroma/web/masto_fe_controller.ex index 557cde328..43ec70021 100644 --- a/lib/pleroma/web/masto_fe_controller.ex +++ b/lib/pleroma/web/masto_fe_controller.ex @@ -5,19 +5,25 @@ defmodule Pleroma.Web.MastoFEController do use Pleroma.Web, :controller + alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug alias Pleroma.Plugs.OAuthScopesPlug alias Pleroma.User plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :put_settings) # Note: :index action handles attempt of unauthenticated access to private instance with redirect + plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action == :index) + plug( OAuthScopesPlug, - %{scopes: ["read"], fallback: :proceed_unauthenticated, skip_instance_privacy_check: true} + %{scopes: ["read"], fallback: :proceed_unauthenticated} when action == :index ) - plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug when action not in [:index, :manifest]) + plug( + :skip_plug, + [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :manifest + ) @doc "GET /web/*path" def index(%{assigns: %{user: user, token: token}} = conn, _params) @@ -43,7 +49,7 @@ defmodule Pleroma.Web.MastoFEController do |> render("manifest.json") end - @doc "PUT /api/web/settings" + @doc "PUT /api/web/settings: Backend-obscure settings blob for MastoFE, don't parse/reuse elsewhere" def put_settings(%{assigns: %{user: user}} = conn, %{"data" => settings} = _params) do with {:ok, _} <- User.mastodon_settings_update(user, settings) do json(conn, %{}) |