From ddb6e5ac7fc753e276fe1176652cf71c647d9c94 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Thu, 20 Dec 2018 01:52:10 +0100 Subject: [PATCH] Return 403 on the method if registrations are not open --- app/controllers/api/v1/accounts_controller.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/app/controllers/api/v1/accounts_controller.rb b/app/controllers/api/v1/accounts_controller.rb index 1c3e2df8a..7ce80ab52 100644 --- a/app/controllers/api/v1/accounts_controller.rb +++ b/app/controllers/api/v1/accounts_controller.rb @@ -5,11 +5,12 @@ class Api::V1::AccountsController < Api::BaseController before_action -> { doorkeeper_authorize! :follow, :'write:follows' }, only: [:follow, :unfollow] before_action -> { doorkeeper_authorize! :follow, :'write:mutes' }, only: [:mute, :unmute] before_action -> { doorkeeper_authorize! :follow, :'write:blocks' }, only: [:block, :unblock] - before_action -> { doorkeeper_authorize! }, only: [:create] + before_action -> { doorkeeper_authorize! :write, :'write:accounts' }, only: [:create] before_action :require_user!, except: [:show, :create] before_action :set_account, except: [:create] before_action :check_account_suspension, only: [:show] + before_action :check_enabled_registrations, only: [:create] respond_to :json @@ -77,4 +78,8 @@ class Api::V1::AccountsController < Api::BaseController def account_params params.permit(:username, :email, :password) end + + def check_enabled_registrations + forbidden if single_user_mode? || !Setting.open_registrations + end end