1 Commits
Author SHA1 Message Date
Thomas Vincent a8e1afba73 Refuse to serve the REST scaffold unless it is switched on (#7716)
* security(api): refuse to serve the REST scaffold unless it is switched on

No route in it consults a realm, a session or a token, and only the missing
vendor tree was keeping the endpoints quiet.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(api): refuse with an empty 404 and use tabs in the test

A JSON error body confirmed an API was behind the refusal, which is what the
404 was chosen to avoid.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: resolve includes through Cacti path constants

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: assert the include form the bootstrap can actually use

CACTI_PATH_INCLUDE is defined by global.php, so it does not exist at the
point that includes it. The file anchors on __DIR__ like its neighbours.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
2026-08-21 12:30:21 -07:00