Cutlery/invoiceninja
1
0
Fork 0
mirror of https://github.com/invoiceninja/invoiceninja.git synced 2025-07-09 03:14:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

Api error handling (#1277)

Browse Source 
* fix env variable

* update routes

* Improve error handling for API_SECRET when testing API endpoint credentials

* exclude /api/v1/ping from API check
This commit is contained in:
David Bomba 2017-01-11 19:13:22 +11:00 committed by GitHub
parent 3c19ac08cd
commit 971653ec7d
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
app/Http/Middleware/ApiCheck.php
View File

@ -25,7 +25,9 @@ class ApiCheck {
{ {
$loggingIn = $request->is('api/v1/login') $loggingIn = $request->is('api/v1/login')
|| $request->is('api/v1/register') || $request->is('api/v1/register')
|| $request->is('api/v1/oauth_login'); || $request->is('api/v1/oauth_login')
|| $request->is('api/v1/ping');
$headers = Utils::getApiHeaders(); $headers = Utils::getApiHeaders();
$hasApiSecret = false; $hasApiSecret = false;
@ -38,7 +40,8 @@ class ApiCheck {
// check API secret // check API secret
if ( ! $hasApiSecret) { if ( ! $hasApiSecret) {
sleep(ERROR_DELAY); sleep(ERROR_DELAY);
return Response::json(['message'=>'Invalid value for API_SECRET'], 403, $headers); $error['error'] = ['message'=>'Invalid value for API_SECRET'];
return Response::json($error, 403, $headers);
} }
} else { } else {
// check for a valid token // check for a valid token
@ -50,7 +53,8 @@ class ApiCheck {
Session::set('token_id', $token->id); Session::set('token_id', $token->id);
} else { } else {
sleep(ERROR_DELAY); sleep(ERROR_DELAY);
return Response::json(['message'=>'Invalid token'], 403, $headers); $error['error'] = ['message'=>'Invalid token'];
return Response::json($error, 403, $headers);
} }
} }
@ -59,7 +63,8 @@ class ApiCheck {
} }
if (!Utils::hasFeature(FEATURE_API) && !$hasApiSecret) { if (!Utils::hasFeature(FEATURE_API) && !$hasApiSecret) {
return Response::json(['message'=>'API requires pro plan'], 403, $headers); $error['error'] = ['message'=>'API requires pro plan'];
return Response::json($error, 403, $headers);
} else { } else {
$key = Auth::check() ? Auth::user()->account->id : $request->getClientIp(); $key = Auth::check() ? Auth::user()->account->id : $request->getClientIp();