From 1036628e6a05dbb7ea73478999c78cf212111f22 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 11 2015 07:28:20 +0000
Subject: [PATCH 1/2] Create an api_authenticated utility method


This method ensure that not only the user is authenticated but that he/she
is at the API level avoiding situation where the user is authenticated in
the web UI and tries to access the API.

---

diff --git a/pagure/__init__.py b/pagure/__init__.py
index c513503..09f4e52 100644
--- a/pagure/__init__.py
+++ b/pagure/__init__.py
@@ -74,6 +74,16 @@ def authenticated():
     return hasattr(flask.g, 'fas_user') and flask.g.fas_user is not None
 
 
+def api_authenticated():
+    ''' Utility function checking if the current user is logged in or not
+    in the API.
+    '''
+    return hasattr(flask.g, 'fas_user') \
+        and flask.g.fas_user is not None \
+        and hasattr(flask.g, 'token') \
+        and flask.g.token is not None
+
+
 def admin_session_timedout():
     ''' Check if the current user has been authenticated for more than what
     is allowed (defaults to 15 minutes).

From 103d653602b56fbe696aeda14b5b8ef207cbca43 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 11 2015 07:29:22 +0000
Subject: [PATCH 2/2] Replace calls to authenticated() by calls to api_authenticated()


---

diff --git a/pagure/api/issue.py b/pagure/api/issue.py
index 0253e1f..7aaf8b6 100644
--- a/pagure/api/issue.py
+++ b/pagure/api/issue.py
@@ -15,7 +15,7 @@ from sqlalchemy.exc import SQLAlchemyError
 import pagure
 import pagure.exceptions
 import pagure.lib
-from pagure import APP, SESSION, is_repo_admin, authenticated
+from pagure import APP, SESSION, is_repo_admin, api_authenticated
 from pagure.api import (
     API, api_method, api_login_required, api_login_optional, APIERROR
 )
@@ -268,7 +268,7 @@ def api_view_issues(repo, username=None):
     # Hide private tickets
     private = False
     # If user is authenticated, show him/her his/her private tickets
-    if authenticated():
+    if api_authenticated():
         if repo != flask.g.token.project:
             raise pagure.exceptions.APIError(
                 401, error_code=APIERROR.EINVALIDTOK)
@@ -372,13 +372,13 @@ def api_view_issue(repo, issueid, username=None):
     if issue is None or issue.project != repo:
         raise pagure.exceptions.APIError(404, error_code=APIERROR.ENOISSUE)
 
-    if authenticated():
+    if api_authenticated():
         if repo != flask.g.token.project:
             raise pagure.exceptions.APIError(
                 401, error_code=APIERROR.EINVALIDTOK)
 
     if issue.private and not is_repo_admin(repo) \
-            and (not authenticated() or
+            and (not api_authenticated() or
                  not issue.user.user == flask.g.fas_user.username):
         raise pagure.exceptions.APIError(
             403, error_code=APIERROR.EISSUENOTALLOWED)
@@ -435,7 +435,7 @@ def api_change_status_issue(repo, issueid, username=None):
         raise pagure.exceptions.APIError(404, error_code=APIERROR.ENOISSUE)
 
     if issue.private and not is_repo_admin(repo) \
-            and (not authenticated() or
+            and (not api_authenticated() or
                  not issue.user.user == flask.g.fas_user.username):
         raise pagure.exceptions.APIError(
             403, error_code=APIERROR.EISSUENOTALLOWED)
@@ -520,7 +520,7 @@ def api_comment_issue(repo, issueid, username=None):
         raise pagure.exceptions.APIError(404, error_code=APIERROR.ENOISSUE)
 
     if issue.private and not is_repo_admin(repo) \
-            and (not authenticated() or
+            and (not api_authenticated() or
                  not issue.user.user == flask.g.fas_user.username):
         raise pagure.exceptions.APIError(
             403, error_code=APIERROR.EISSUENOTALLOWED)