Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
heptapod
heptapod
Commits
86e61c58f8de
Commit
33da792f
authored
Nov 23, 2017
by
Douwe Maan
Browse files
Fix pulling and pushing using a personal access token with the sudo scope
parent
d76dc310ba79
Changes
3
Hide whitespace changes
Inline
Side-by-side
changelogs/unreleased/dm-fix-registry-with-sudo-token.yml
0 → 100644
View file @
86e61c58
---
title
:
Fix pulling and pushing using a personal access token with the sudo scope
merge_request
:
author
:
type
:
fixed
lib/gitlab/auth.rb
View file @
86e61c58
...
...
@@ -128,7 +128,7 @@ def personal_access_token_check(password)
token
=
PersonalAccessTokensFinder
.
new
(
state:
'active'
).
find_by
(
token:
password
)
if
token
&&
valid_scoped_token?
(
token
,
available_scopes
)
Gitlab
::
Auth
::
Result
.
new
(
token
.
user
,
nil
,
:personal_access_token
,
abilities_for_scope
(
token
.
scopes
))
Gitlab
::
Auth
::
Result
.
new
(
token
.
user
,
nil
,
:personal_access_token
,
abilities_for_scope
s
(
token
.
scopes
))
end
end
...
...
@@ -140,10 +140,15 @@ def valid_scoped_token?(token, scopes)
AccessTokenValidationService
.
new
(
token
).
include_any_scope?
(
scopes
)
end
def
abilities_for_scope
(
scopes
)
scopes
.
map
do
|
scope
|
self
.
public_send
(
:"
#{
scope
}
_scope_authentication_abilities"
)
# rubocop:disable GitlabSecurity/PublicSend
end
.
flatten
.
uniq
def
abilities_for_scopes
(
scopes
)
abilities_by_scope
=
{
api:
full_authentication_abilities
,
read_registry:
[
:read_container_image
]
}
scopes
.
flat_map
do
|
scope
|
abilities_by_scope
.
fetch
(
scope
.
to_sym
,
[])
end
.
uniq
end
def
lfs_token_check
(
login
,
password
,
project
)
...
...
@@ -222,16 +227,6 @@ def full_authentication_abilities
:admin_container_image
]
end
alias_method
:api_scope_authentication_abilities
,
:full_authentication_abilities
def
read_registry_scope_authentication_abilities
[
:read_container_image
]
end
# The currently used auth method doesn't allow any actions for this scope
def
read_user_scope_authentication_abilities
[]
end
def
available_scopes
(
current_user
=
nil
)
scopes
=
API_SCOPES
+
registry_scopes
...
...
spec/lib/gitlab/auth_spec.rb
View file @
86e61c58
...
...
@@ -207,7 +207,7 @@ def operation
end
it
'limits abilities based on scope'
do
personal_access_token
=
create
(
:personal_access_token
,
scopes:
[
'
read_user
'
])
personal_access_token
=
create
(
:personal_access_token
,
scopes:
%w
[read_user
sudo
]
)
expect
(
gl_auth
).
to
receive
(
:rate_limit!
).
with
(
'ip'
,
success:
true
,
login:
''
)
expect
(
gl_auth
.
find_for_git_client
(
''
,
personal_access_token
.
token
,
project:
nil
,
ip:
'ip'
)).
to
eq
(
Gitlab
::
Auth
::
Result
.
new
(
personal_access_token
.
user
,
nil
,
:personal_access_token
,
[]))
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment