Skip to content
GitLab
Menu
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
heptapod
heptapod
Commits
b092e6536e95
Commit
b092e653
authored
Feb 06, 2018
by
Tiago Botelho
Browse files
Check ability ability before proceeding with project specific checks
parent
dc464f5ceee9
Changes
4
Hide whitespace changes
Inline
Side-by-side
GITLAB_SHELL_VERSION
View file @
b092e653
6.0.
3
6.0.
2
lib/gitlab/git_access.rb
View file @
b092e653
...
...
@@ -12,8 +12,9 @@
ERROR_MESSAGES
=
{
upload:
'You are not allowed to upload code for this project.'
,
download:
'You are not allowed to download code from this project.'
,
deploy_key_upload:
'This deploy key does not have write access to this project.'
,
auth_upload:
'You are not allowed to upload code.'
,
auth_download:
'You are not allowed to download code.'
,
deploy_key_upload:
'This deploy key does not have write access to this project.'
,
no_repo:
'A repository for this project does not exist yet.'
,
project_not_found:
'The project you were looking for could not be found.'
,
account_blocked:
'Your account has been blocked.'
,
...
...
@@ -44,6 +45,7 @@
check_protocol!
check_valid_actor!
check_active_user!
check_authentication_abilities!
(
cmd
)
check_command_disabled!
(
cmd
)
check_command_existence!
(
cmd
)
check_db_accessibility!
(
cmd
)
...
...
@@ -104,6 +106,19 @@
end
end
def
check_authentication_abilities!
(
cmd
)
case
cmd
when
*
DOWNLOAD_COMMANDS
unless
authentication_abilities
.
include?
(
:download_code
)
||
authentication_abilities
.
include?
(
:build_download_code
)
raise
UnauthorizedError
,
ERROR_MESSAGES
[
:auth_download
]
end
when
*
PUSH_COMMANDS
unless
authentication_abilities
.
include?
(
:push_code
)
raise
UnauthorizedError
,
ERROR_MESSAGES
[
:auth_upload
]
end
end
end
def
check_project_accessibility!
if
project
.
blank?
||
!
can_read_project?
raise
NotFoundError
,
ERROR_MESSAGES
[
:project_not_found
]
...
...
@@ -205,5 +220,7 @@
end
if
deploy_key
check_deploy_key_push_access!
unless
deploy_key
.
can_push_to?
(
project
)
raise
UnauthorizedError
,
ERROR_MESSAGES
[
:deploy_key_upload
]
end
elsif
user
...
...
@@ -209,6 +226,6 @@
elsif
user
check_user_push
_access!
# User access is verified in check_change
_access!
else
raise
UnauthorizedError
,
ERROR_MESSAGES
[
:upload
]
end
...
...
@@ -211,7 +228,9 @@
else
raise
UnauthorizedError
,
ERROR_MESSAGES
[
:upload
]
end
return
if
changes
.
blank?
# Allow access this is needed for EE.
check_change_access!
(
changes
)
end
...
...
@@ -215,16 +234,4 @@
check_change_access!
(
changes
)
end
def
check_user_push_access!
unless
authentication_abilities
.
include?
(
:push_code
)
raise
UnauthorizedError
,
ERROR_MESSAGES
[
:upload
]
end
end
def
check_deploy_key_push_access!
unless
deploy_key
.
can_push_to?
(
project
)
raise
UnauthorizedError
,
ERROR_MESSAGES
[
:deploy_key_upload
]
end
end
def
check_change_access!
(
changes
)
...
...
@@ -230,6 +237,4 @@
def
check_change_access!
(
changes
)
return
if
changes
.
blank?
# Allow access.
changes_list
=
Gitlab
::
ChangesList
.
new
(
changes
)
# Iterate over all changes to find if user allowed all of them to be applied
...
...
spec/lib/gitlab/git_access_spec.rb
View file @
b092e653
...
...
@@ -119,7 +119,7 @@
end
it
'does not block pushes with "not found"'
do
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:upload
])
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:
auth_
upload
])
end
end
end
...
...
@@ -327,7 +327,7 @@
let
(
:authentication_abilities
)
{
[]
}
it
'raises unauthorized with download error'
do
expect
{
pull_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:download
])
expect
{
pull_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:
auth_
download
])
end
context
'when authentication abilities include download code'
do
...
...
@@ -351,7 +351,7 @@
let
(
:authentication_abilities
)
{
[]
}
it
'raises unauthorized with push error'
do
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:upload
])
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:
auth_
upload
])
end
context
'when authentication abilities include push code'
do
...
...
@@ -852,10 +852,10 @@
project
.
add_reporter
(
user
)
end
it
{
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:upload
])
}
it
{
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:
auth_
upload
])
}
end
context
'when unauthorized'
do
context
'to public project'
do
let
(
:project
)
{
create
(
:project
,
:public
,
:repository
)
}
...
...
@@ -856,12 +856,12 @@
end
context
'when unauthorized'
do
context
'to public project'
do
let
(
:project
)
{
create
(
:project
,
:public
,
:repository
)
}
it
{
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:upload
])
}
it
{
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:
auth_
upload
])
}
end
context
'to internal project'
do
let
(
:project
)
{
create
(
:project
,
:internal
,
:repository
)
}
...
...
@@ -863,11 +863,11 @@
end
context
'to internal project'
do
let
(
:project
)
{
create
(
:project
,
:internal
,
:repository
)
}
it
{
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:upload
])
}
it
{
expect
{
push_access_check
}.
to
raise_unauthorized
(
described_class
::
ERROR_MESSAGES
[
:
auth_
upload
])
}
end
context
'to private project'
do
let
(
:project
)
{
create
(
:project
,
:private
,
:repository
)
}
...
...
@@ -869,9 +869,9 @@
end
context
'to private project'
do
let
(
:project
)
{
create
(
:project
,
:private
,
:repository
)
}
it
{
expect
{
push_access_check
}.
to
raise_
not_found
}
it
{
expect
{
push_access_check
}.
to
raise_
unauthorized
(
described_class
::
ERROR_MESSAGES
[
:auth_upload
])
}
end
end
end
...
...
spec/requests/git_http_spec.rb
View file @
b092e653
...
...
@@ -620,7 +620,7 @@
push_get
(
path
,
env
)
expect
(
response
).
to
have_gitlab_http_status
(
:forbidden
)
expect
(
response
.
body
).
to
eq
(
git_access_error
(
:upload
))
expect
(
response
.
body
).
to
eq
(
git_access_error
(
:
auth_
upload
))
end
# We are "authenticated" as CI using a valid token here. But we are
...
...
@@ -660,7 +660,7 @@
push_get
path
,
env
expect
(
response
).
to
have_gitlab_http_status
(
:forbidden
)
expect
(
response
.
body
).
to
eq
(
git_access_error
(
:upload
))
expect
(
response
.
body
).
to
eq
(
git_access_error
(
:
auth_
upload
))
end
end
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment