Commit 8b6041bc authored by Rémy Coutable's avatar Rémy Coutable
Browse files

Don't try to find a user by personal_access_token if the token is nil


Signed-off-by: default avatarRémy Coutable <remy@rymai.me>
parent c4825e1a07d5
......@@ -64,8 +64,11 @@ def route_not_found
# This filter handles both private tokens and personal access tokens
def authenticate_user_from_private_token!
token_string = params[:private_token].presence || request.headers['PRIVATE-TOKEN'].presence
user = User.find_by_authentication_token(token_string) || User.find_by_personal_access_token(token_string)
token = params[:private_token].presence || request.headers['PRIVATE-TOKEN'].presence
return unless token.present?
user = User.find_by_authentication_token(token) || User.find_by_personal_access_token(token)
if user && can?(user, :log_in)
# Notice we are passing store false, so the user is not
......
......@@ -324,6 +324,8 @@ def find_by_username!(username)
end
def find_by_personal_access_token(token_string)
return unless token_string
PersonalAccessTokensFinder.new(state: 'active').find_by(token: token_string)&.user
end
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment