Don't allow directory listings of the public directory without proper permissions (refs #19)

2012-10-29 12:38:10 +01:00
parent 6541b97997
commit 39355ff0f2
4 changed files with 181 additions and 5 deletions
--- a/liquor-cabinet.rb
+++ b/liquor-cabinet.rb
@@ -49,7 +49,7 @@ class LiquorCabinet < Sinatra::Base

      token = env["HTTP_AUTHORIZATION"] ? env["HTTP_AUTHORIZATION"].split(" ")[1] : ""

-      authorize_request(@user, @directory, token) unless request.options?
+      authorize_request(@user, @directory, token, @key.blank?) unless request.options?
    end
  end