johanels/photoprism
1
0
Fork 0
mirror of https://github.com/photoprism/photoprism.git synced 2025-12-12 00:34:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Security: Refactor cache headers, auth token validation & UI #782 #808

Browse Source 
Signed-off-by: Michael Mayer <michael@photoprism.app>
This commit is contained in:
Michael Mayer
2024-01-17 14:16:02 +01:00
parent 0c4cd8d1b9
commit 2912ac9464
21 changed files with 367 additions and 197 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
internal/api/api_auth.go
View File

@@ -31,10 +31,12 @@ func AuthAny(c *gin.Context, resource acl.Resource, grants acl.Permissions) (s *
if s = Session(clientIp, authToken); s == nil {
event.AuditWarn([]string{clientIp, "unauthenticated", "%s %s", "denied"}, grants.String(), string(resource))
return entity.SessionStatusUnauthorized()
} else {
s.SetClientIP(clientIp)
}
// Disable caching of responses and the client IP.
c.Header(header.CacheControl, header.CacheControlNoStore)
s.SetClientIP(clientIp)
// If the request is from a client application, check its authorization based
// on the allowed scope, the ACL, and the user account it belongs to (if any).
if s.IsClient() {