remote/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-31 23:47:47 +01:00
Code Issues Projects Releases Packages Wiki Activity

feat(api): restrict access to library and config endpoints to admin users

Browse source 
Signed-off-by: Deluan <deluan@navidrome.org>
This commit is contained in:
Deluan 2025-06-06 14:54:28 -04:00
commit 7dce0da557
5 changed files with 178 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

6
server/nativeapi/inspect.go
View file

@ -9,7 +9,6 @@ import (
"github.com/navidrome/navidrome/core"
"github.com/navidrome/navidrome/log"
"github.com/navidrome/navidrome/model"
"github.com/navidrome/navidrome/model/request"
"github.com/navidrome/navidrome/utils/req"
)
@ -30,11 +29,6 @@ func inspect(ds model.DataStore) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
user, _ := request.UserFrom(ctx)
if !user.IsAdmin {
http.Error(w, "Inspect is only available to admin users", http.StatusUnauthorized)
}
p := req.Params(r)
id, err := p.String("id")