Disable API access when login is disabled (#7289)

This commit is contained in:
Eugen Rochko 2018-04-30 09:13:14 +02:00 committed by GitHub
parent 295e3ef02b
commit f62ee1ddb0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -66,8 +66,10 @@ class Api::BaseController < ApplicationController
end
def require_user!
if current_user
if current_user && !current_user.disabled?
set_user_activity
elsif current_user
render json: { error: 'Your login is currently disabled' }, status: 403
else
render json: { error: 'This method requires an authenticated user' }, status: 422
end