6230f5c554
This refactors default_current_user_provider in a few ways: - Introduce a generic `api_parameter_allowed?` method which checks for whitelisted routes/formats - Only read the api_key parameter on allowed routes. It is now completely ignored on other routes (previously it would raise a 403) - Start reading user_api_key parameter on allowed routes - Refactor tests as end-end integration tests A plugin API for PARAMETER_API_PATTERNS will be added soon |
||
|---|---|---|
| .. | ||
| api_keys_spec.rb | ||
| category_tag_spec.rb | ||
| content_security_policy_spec.rb | ||
| email_style_spec.rb | ||
| flags_spec.rb | ||
| group_spec.rb | ||
| invite_only_registration_spec.rb | ||
| message_bus_spec.rb | ||
| multisite_spec.rb | ||
| rate_limiting_spec.rb | ||
| same_ip_spammers_spec.rb | ||
| spam_rules_spec.rb | ||
| topic_auto_close_spec.rb | ||
| topic_thumbnail_spec.rb | ||
| watched_words_spec.rb | ||