Make API call permission checks more reliable

- don't need to inherit every Module method anymore

diff --git a/src/Module/BaseApi.php b/src/Module/BaseApi.php
index cd9cfb8f5cd06948713d0a7e17d6d1bc4e662559..db5f191cf1d0bd6b63c421f82ab4598544afc667 100644 (file)
--- a/src/Module/BaseApi.php
+++ b/src/Module/BaseApi.php
@@ -22,6 +22,7 @@
 namespace Friendica\Module;
 
 use Friendica\App;
+use Friendica\App\Router;
 use Friendica\BaseModule;
 use Friendica\Core\L10n;
 use Friendica\Core\Logger;
@@ -36,6 +37,7 @@ use Friendica\Security\BasicAuth;
 use Friendica\Security\OAuth;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Profiler;
+use Psr\Http\Message\ResponseInterface;
 use Psr\Log\LoggerInterface;
 
 class BaseApi extends BaseModule
@@ -70,40 +72,29 @@ class BaseApi extends BaseModule
                $this->app = $app;
        }
 
-       protected function delete(array $request = [])
-       {
-               self::checkAllowedScope(self::SCOPE_WRITE);
-
-               if (!$this->app->isLoggedIn()) {
-                       throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
-               }
-       }
-
-       protected function patch(array $request = [])
-       {
-               self::checkAllowedScope(self::SCOPE_WRITE);
-
-               if (!$this->app->isLoggedIn()) {
-                       throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
-               }
-       }
-
-       protected function post(array $request = [])
+       /**
+        * Additionally checks, if the caller is permitted to do this action
+        *
+        * {@inheritDoc}
+        *
+        * @throws HTTPException\ForbiddenException
+        */
+       public function run(array $request = []): ResponseInterface
        {
-               self::checkAllowedScope(self::SCOPE_WRITE);
-
-               if (!$this->app->isLoggedIn()) {
-                       throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
+               switch ($this->server['REQUEST_METHOD'] ?? Router::GET) {
+                       case Router::DELETE:
+                       case Router::PATCH:
+                       case Router::POST:
+                       case Router::PUT:
+                               self::checkAllowedScope(self::SCOPE_WRITE);
+
+                               if (!$this->app->isLoggedIn()) {
+                                       throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
+                               }
+                               break;
                }
-       }
-
-       public function put(array $request = [])
-       {
-               self::checkAllowedScope(self::SCOPE_WRITE);
 
-               if (!$this->app->isLoggedIn()) {
-                       throw new HTTPException\ForbiddenException($this->t('Permission denied.'));
-               }
+               return parent::run($request);
        }
 
        /**