From b104ab3ca1690f35d0674d3807681390e640e5c8 Mon Sep 17 00:00:00 2001
From: Piotr Orzechowski <piotr@orzechowski.tech>
Date: Wed, 14 Feb 2018 05:46:00 +0100
Subject: [PATCH] Add option to enable or disable swagger endpoints (#3502)

---
 custom/conf/app.ini.sample | 2 ++
 modules/context/context.go | 1 +
 modules/setting/setting.go | 6 ++++--
 routers/api/v1/api.go      | 9 +++++++--
 templates/base/footer.tmpl | 2 +-
 5 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/custom/conf/app.ini.sample b/custom/conf/app.ini.sample
index 57fa5ec3d..7876f0a7b 100644
--- a/custom/conf/app.ini.sample
+++ b/custom/conf/app.ini.sample
@@ -553,6 +553,8 @@ DEFAULT_INTERVAL = 8h
 MIN_INTERVAL = 10m
 
 [api]
+; Enables /api/swagger, /api/v1/swagger etc. endpoints. True or false; default is true.
+ENABLE_SWAGGER_ENDPOINT = true
 ; Max number of items will response in a page
 MAX_RESPONSE_ITEMS = 50
 
diff --git a/modules/context/context.go b/modules/context/context.go
index 311186e64..ea2618439 100644
--- a/modules/context/context.go
+++ b/modules/context/context.go
@@ -243,6 +243,7 @@ func Contexter() macaron.Handler {
 		ctx.Data["ShowRegistrationButton"] = setting.Service.ShowRegistrationButton
 		ctx.Data["ShowFooterBranding"] = setting.ShowFooterBranding
 		ctx.Data["ShowFooterVersion"] = setting.ShowFooterVersion
+		ctx.Data["EnableSwaggerEndpoint"] = setting.API.EnableSwaggerEndpoint
 		ctx.Data["EnableOpenIDSignIn"] = setting.Service.EnableOpenIDSignIn
 
 		c.Map(ctx)
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index 338637836..936dac85c 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -515,9 +515,11 @@ var (
 
 	// API settings
 	API = struct {
-		MaxResponseItems int
+		EnableSwaggerEndpoint bool
+		MaxResponseItems      int
 	}{
-		MaxResponseItems: 50,
+		EnableSwaggerEndpoint: true,
+		MaxResponseItems:      50,
 	}
 
 	// I18n settings
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 6bbc01426..240bb2fc4 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -50,6 +50,7 @@ import (
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/auth"
 	"code.gitea.io/gitea/modules/context"
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/routers/api/v1/admin"
 	"code.gitea.io/gitea/routers/api/v1/misc"
 	"code.gitea.io/gitea/routers/api/v1/org"
@@ -277,11 +278,15 @@ func mustAllowPulls(ctx *context.Context) {
 func RegisterRoutes(m *macaron.Macaron) {
 	bind := binding.Bind
 
-	m.Get("/swagger", misc.Swagger) //Render V1 by default
+	if setting.API.EnableSwaggerEndpoint {
+		m.Get("/swagger", misc.Swagger) //Render V1 by default
+	}
 
 	m.Group("/v1", func() {
 		// Miscellaneous
-		m.Get("/swagger", misc.Swagger)
+		if setting.API.EnableSwaggerEndpoint {
+			m.Get("/swagger", misc.Swagger)
+		}
 		m.Get("/version", misc.Version)
 		m.Post("/markdown", bind(api.MarkdownOption{}), misc.Markdown)
 		m.Post("/markdown/raw", misc.MarkdownRaw)
diff --git a/templates/base/footer.tmpl b/templates/base/footer.tmpl
index 70691659f..18d59d92c 100644
--- a/templates/base/footer.tmpl
+++ b/templates/base/footer.tmpl
@@ -29,7 +29,7 @@
 					</div>
 				</div>
 				<a href="{{AppSubUrl}}/vendor/librejs.html" data-jslicense="1">JavaScript licenses</a>
-				<a href="{{AppSubUrl}}/api/swagger">API</a>
+				{{if .EnableSwaggerEndpoint}}<a href="{{AppSubUrl}}/api/swagger">API</a>{{end}}
 				<a target="_blank" rel="noopener" href="https://gitea.io">{{.i18n.Tr "website"}}</a>
 				{{if (or .ShowFooterVersion .PageIsAdmin)}}<span class="version">{{GoVer}}</span>{{end}}
 			</div>