Read about our upcoming Code of Conduct on this issue

Commit b44f26ee authored by Sean McGivern's avatar Sean McGivern Committed by Tiago
Browse files

Merge branch 'dm-fix-registry-with-sudo-token' into 'master'

Fix pulling and pushing using a personal access token with the sudo scope

Closes #40466

See merge request gitlab-org/gitlab-ce!15571

(cherry picked from commit 89c9d2ad6b792885d234f153f2e13ee96639e4f8)

453b1780 Fix pulling and pushing using a personal access token with the sudo scope
parent fe9bf8fb8039
---
title: Fix pulling and pushing using a personal access token with the sudo scope
merge_request:
author:
type: fixed
......@@ -128,7 +128,7 @@ def personal_access_token_check(password)
token = PersonalAccessTokensFinder.new(state: 'active').find_by(token: password)
if token && valid_scoped_token?(token, available_scopes)
Gitlab::Auth::Result.new(token.user, nil, :personal_access_token, abilities_for_scope(token.scopes))
Gitlab::Auth::Result.new(token.user, nil, :personal_access_token, abilities_for_scopes(token.scopes))
end
end
......@@ -140,10 +140,15 @@ def valid_scoped_token?(token, scopes)
AccessTokenValidationService.new(token).include_any_scope?(scopes)
end
def abilities_for_scope(scopes)
scopes.map do |scope|
self.public_send(:"#{scope}_scope_authentication_abilities") # rubocop:disable GitlabSecurity/PublicSend
end.flatten.uniq
def abilities_for_scopes(scopes)
abilities_by_scope = {
api: full_authentication_abilities,
read_registry: [:read_container_image]
}
scopes.flat_map do |scope|
abilities_by_scope.fetch(scope.to_sym, [])
end.uniq
end
def lfs_token_check(login, password, project)
......@@ -222,16 +227,6 @@ def full_authentication_abilities
:admin_container_image
]
end
alias_method :api_scope_authentication_abilities, :full_authentication_abilities
def read_registry_scope_authentication_abilities
[:read_container_image]
end
# The currently used auth method doesn't allow any actions for this scope
def read_user_scope_authentication_abilities
[]
end
def available_scopes(current_user = nil)
scopes = API_SCOPES + registry_scopes
......
......@@ -207,7 +207,7 @@ def operation
end
it 'limits abilities based on scope' do
personal_access_token = create(:personal_access_token, scopes: ['read_user'])
personal_access_token = create(:personal_access_token, scopes: %w[read_user sudo])
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: '')
expect(gl_auth.find_for_git_client('', personal_access_token.token, project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new(personal_access_token.user, nil, :personal_access_token, []))
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment