Commit 0ea04cc5 authored by http://jneen.net/'s avatar http://jneen.net/
Browse files

use the policy stack to protect logins

parent 998596834a5b
......@@ -67,7 +67,7 @@ def authenticate_user_from_private_token!
token_string = params[:private_token].presence || request.headers['PRIVATE-TOKEN'].presence
user = User.find_by_authentication_token(token_string) || User.find_by_personal_access_token(token_string)
if user
if user && can?(user, :log_in)
# Notice we are passing store false, so the user is not
# actually stored in the session and a token is needed
# for every request. If you want the token to work as a
......
......@@ -23,7 +23,7 @@ module AuthenticatesWithTwoFactor
#
# Returns nil
def prompt_for_two_factor(user)
return locked_user_redirect(user) if user.access_locked?
return locked_user_redirect(user) unless user.can?(:log_in)
session[:otp_user_id] = user.id
setup_u2f_authentication(user)
......@@ -37,10 +37,9 @@ def locked_user_redirect(user)
def authenticate_with_two_factor
user = self.resource = find_user
return locked_user_redirect(user) unless user.can?(:log_in)
if user.access_locked?
locked_user_redirect(user)
elsif user_params[:otp_attempt].present? && session[:otp_user_id]
if user_params[:otp_attempt].present? && session[:otp_user_id]
authenticate_with_two_factor_via_otp(user)
elsif user_params[:device_response].present? && session[:otp_user_id]
authenticate_with_two_factor_via_u2f(user)
......
......@@ -6,7 +6,7 @@ def rules
can! :read_users_list
unless @user.blocked? || @user.internal?
can! :log_in
can! :log_in unless @user.access_locked?
can! :access_api
can! :access_git
end
......
......@@ -97,7 +97,7 @@ def find_merge_request_with_access(iid, access_level = :read_merge_request)
end
def authenticate!
unauthorized! unless current_user
unauthorized! unless current_user && can?(current_user, :access_api)
end
def authenticate_non_get!
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment