we have to allow message bus for read clients

2016-08-19 15:22:52 +10:00 · 2016-08-19 15:22:52 +10:00 · b09922b58a
parent 9b1e81cd6d
commit b09922b58a
1 changed files with 1 additions and 1 deletions
--- a/lib/auth/default_current_user_provider.rb
+++ b/lib/auth/default_current_user_provider.rb
@ -178,7 +178,7 @@ class Auth::DefaultCurrentUserProvider

  def lookup_user_api_user(user_api_key)
    if api_key = UserApiKey.where(key: user_api_key, revoked_at: nil).includes(:user).first
-      if !api_key.write && @env["REQUEST_METHOD"] != "GET"
+      if !api_key.write && (@env["REQUEST_METHOD"] != "GET" && @env["PATH_INFO"] !~ /^\/message-bus\/.*\/poll/)
        raise Discourse::InvalidAccess
      end