MT#3927 Invalidate session in API for non-API user

12 years ago · a5cbfd298a
parent e5a42d9306
commit a5cbfd298a
1 changed files with 8 additions and 0 deletions
--- a/lib/NGCP/Panel/Controller/Root.pm
+++ b/lib/NGCP/Panel/Controller/Root.pm
@ -26,6 +26,14 @@ sub auto :Private {
        $c->log->debug("*** Root::auto skip authn, grant access to " . $c->request->path);
        return 1;
    }
+
+    if($c->user_exists && $c->user->roles ne "api_admin" &&
+       0 == index $c->controller->catalyst_component_name, 'NGCP::Panel::Controller::API') {
+        
+        $c->log->debug("*** Root::auto invalidate authenticated non-api-admin user for api access");
+        $c->logout;
+    }
+
    unless($c->user_exists) {
        $c->log->debug("*** Root::auto user not authenticated");
        if (