Commit 97ab3ff8 authored by Alexis POYEN's avatar Alexis POYEN
Browse files

Remove : IsAllowed was not used anymore

parent 36497ade
......@@ -191,44 +191,6 @@ func GetTokenData(r *http.Request) (TokenData, error) {
return user, nil
}
// IsAllowed let to know if a user is in a list of group or not
func IsAllowed(w http.ResponseWriter, r *http.Request, allowedRoles []string) bool {
user := TokenData{}
checkXSRF, err := tokens.Manager.ExtractAndValidateToken(r, authTokenKey, &user, true)
// Handle CORS preflight requests
if err != nil && r.Method == "OPTIONS" {
// Handle GIO preflight requests
if strings.Contains(r.UserAgent(), "vfs") || strings.Contains(r.UserAgent(), "Microsoft-WebDAV") {
w.Header().Set("WWW-Authenticate", `Basic realm="server"`)
http.Error(w, "webdav client authentication", 401)
}
return false
}
if err != nil {
redirectTo := os.Getenv("HOSTNAME")
_, port, perr := net.SplitHostPort(r.Host)
if perr == nil {
redirectTo += ":" + port
}
w.Header().Set("Content-Type", "text/html")
w.WriteHeader(http.StatusUnauthorized)
responseContent := fmt.Sprintf("error extracting token: %v<meta http-equiv=\"Refresh\" content=\"0; url=https://%v/#login\"/>", err.Error(), redirectTo)
fmt.Fprintf(w, responseContent)
return false
}
// Check XSRF Token
if checkXSRF && r.Header.Get("XSRF-TOKEN") != user.XSRFToken {
http.Error(w, "XSRF protection triggered", 401)
return false
}
err = checkUserHasRole(user, allowedRoles)
if err != nil {
http.Error(w, "You're not authorize to execute this method on this ressource.", http.StatusMethodNotAllowed)
return false
}
return true
}
// GetLoggedUserTechnical return the User authenticated
func GetLoggedUserTechnical(w http.ResponseWriter, r *http.Request) User {
user := TokenData{}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment