Commit c2b33d3b authored by James Lopez's avatar James Lopez
Browse files

added import url exposer to construct URL withunencrypted credentials

parent 4c74ed9d1cb1
......@@ -13,6 +13,7 @@
class ProjectImportData < ActiveRecord::Base
belongs_to :project
attr_encrypted :credentials, key: Gitlab::Application.secrets.db_key_base
serialize :credentials, JSON
serialize :data, JSON
......
......@@ -7,8 +7,7 @@ class Importer
def initialize(project)
@project = project
import_data = project.import_data.try(:data)
github_session = import_data["github_session"] if import_data
github_session = project.import_data.credentials if import_data
@client = Client.new(github_session["github_access_token"])
@formatter = Gitlab::ImportFormatter.new
end
......
......@@ -32,8 +32,8 @@ def execute
def create_import_data(project)
project.create_import_data(
credentials: session_data.delete(:github_access_token),
data: { "github_session" => session_data })
credentials: { github_access_token: session_data.delete(:github_access_token) },
data: { github_session: session_data })
end
end
end
......
......@@ -12,7 +12,9 @@ def path_with_namespace
end
def import_url
project.import_url.sub(/\.git\z/, ".wiki.git")
import_url = Gitlab::ImportUrlExposer.expose(import_url: project.import_url,
credentials: project.import_data.credentials)
import_url.sub(/\.git\z/, ".wiki.git")
end
end
end
......
module Gitlab
# Exposes an import URL that includes the credentials unencrypted.
# Extracted to its own class to prevent unintended use.
module ImportUrlExposer
extend self
def expose(import_url:, credentials: )
import_url.sub("//", "//#{parsed_credentials(credentials)}@")
end
private
def parsed_credentials(credentials)
credentials.values.join(":")
end
end
end
\ No newline at end of file
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment