paradizelost/paperless-ngx
1
0
Fork 0
mirror of https://github.com/paperless-ngx/paperless-ngx.git synced 2025-08-12 00:19:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security: disallow API remote-user auth if disabled (#6739)

Browse Source
This commit is contained in:
shamoon
2024-05-15 13:18:50 -07:00
committed by GitHub
parent 97eec44647
commit ed05b40ba4
2 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/paperless/auth.py
View File

@@ -52,6 +52,17 @@ class HttpRemoteUserMiddleware(PersistentRemoteUserMiddleware):
header = settings.HTTP_REMOTE_USER_HEADER_NAME
def process_request(self, request: HttpRequest) -> None:
# If remote user auth is enabled only for the frontend, not the API,
# then we need dont want to authenticate the user for API requests.
if (
"/api/" in request.path
and "paperless.auth.PaperlessRemoteUserAuthentication"
not in settings.REST_FRAMEWORK["DEFAULT_AUTHENTICATION_CLASSES"]
):
return
return super().process_request(request)
class PaperlessRemoteUserAuthentication(authentication.RemoteUserAuthentication):
"""