Skip to content
Snippets Groups Projects

Omnibus Gitlab 16.2 branching point

Merged Georges Racinet requested to merge topic/heptapod/gitlab-16.2 into branch/heptapod
103 files
+ 1661
845
Compare changes
  • Side-by-side
  • Inline
Files
103
commit 6997c02b5f36a45760bf6ee273b5379fb1c7bcd6
Author: Ankit Panchal <apanchal@gitlab.com>
Date: Tue Aug 23 15:55:18 2022 +0000
#65 Security fix needed for CVE-2022-31107 - Grafana account takeover via OAuth vulnerability
diff --git a/pkg/api/ldap_debug.go b/pkg/api/ldap_debug.go
index ffb7edbae2..c3525362c9 100644
--- a/pkg/api/ldap_debug.go
+++ b/pkg/api/ldap_debug.go
@@ -215,6 +215,11 @@ func (hs *HTTPServer) PostSyncUserWithLDAP(c *models.ReqContext) response.Respon
ReqContext: c,
ExternalUser: user,
SignupAllowed: hs.Cfg.LDAPAllowSignup,
+ UserSearchParams: models.UserSearchParams{
+ UserId: &query.Result.Id,
+ Email: nil,
+ Login: nil,
+ },
}
err = bus.Dispatch(upsertCmd)
diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go
index 873b4a12a3..fec9ca1cd4 100644
--- a/pkg/api/login_oauth.go
+++ b/pkg/api/login_oauth.go
@@ -250,6 +250,11 @@ func syncUser(
ReqContext: ctx,
ExternalUser: extUser,
SignupAllowed: connect.IsSignupAllowed(),
+ UserSearchParams: models.UserSearchParams{
+ Email: &extUser.Email,
+ UserId: nil,
+ Login: nil,
+ },
}
if err := bus.Dispatch(cmd); err != nil {
return nil, err
diff --git a/pkg/login/ldap_login.go b/pkg/login/ldap_login.go
index 2a5f852d73..65bf7b0805 100644
--- a/pkg/login/ldap_login.go
+++ b/pkg/login/ldap_login.go
@@ -56,6 +56,11 @@ var loginUsingLDAP = func(query *models.LoginUserQuery) (bool, error) {
ReqContext: query.ReqContext,
ExternalUser: externalUser,
SignupAllowed: setting.LDAPAllowSignup,
+ UserSearchParams: models.UserSearchParams{
+ Login: &externalUser.Login,
+ Email: &externalUser.Email,
+ UserId: nil,
+ },
}
err = bus.Dispatch(upsert)
if err != nil {
diff --git a/pkg/models/user_auth.go b/pkg/models/user_auth.go
index 1782c0d3a9..e8c64bca3b 100644
--- a/pkg/models/user_auth.go
+++ b/pkg/models/user_auth.go
@@ -57,6 +57,7 @@ type UpsertUserCommand struct {
ReqContext *ReqContext
ExternalUser *ExternalUserInfo
SignupAllowed bool
+ UserSearchParams
Result *User
}
@@ -98,10 +99,17 @@ type GetUserByAuthInfoQuery struct {
UserId int64
Email string
Login string
+ UserSearchParams
Result *User
}
+type UserSearchParams struct {
+ UserId *int64
+ Email *string
+ Login *string
+}
+
type GetExternalUserInfoByLoginQuery struct {
LoginOrEmail string
diff --git a/pkg/services/contexthandler/authproxy/authproxy.go b/pkg/services/contexthandler/authproxy/authproxy.go
index 63cbda9a4b..3d6b45646d 100644
--- a/pkg/services/contexthandler/authproxy/authproxy.go
+++ b/pkg/services/contexthandler/authproxy/authproxy.go
@@ -246,6 +246,11 @@ func (auth *AuthProxy) LoginViaLDAP() (int64, error) {
ReqContext: auth.ctx,
SignupAllowed: auth.cfg.LDAPAllowSignup,
ExternalUser: extUser,
+ UserSearchParams: models.UserSearchParams{
+ Login: &extUser.Login,
+ Email: &extUser.Email,
+ UserId: nil,
+ },
}
if err := bus.Dispatch(upsert); err != nil {
return 0, err
@@ -288,6 +293,11 @@ func (auth *AuthProxy) LoginViaHeader() (int64, error) {
ReqContext: auth.ctx,
SignupAllowed: auth.cfg.AuthProxyAutoSignUp,
ExternalUser: extUser,
+ UserSearchParams: models.UserSearchParams{
+ UserId: nil,
+ Login: &extUser.Login,
+ Email: &extUser.Email,
+ },
}
err := bus.Dispatch(upsert)
diff --git a/pkg/services/login/login.go b/pkg/services/login/login.go
index 3af945fce1..0269485fe7 100644
--- a/pkg/services/login/login.go
+++ b/pkg/services/login/login.go
@@ -37,11 +37,12 @@ func (ls *LoginService) UpsertUser(cmd *models.UpsertUserCommand) error {
extUser := cmd.ExternalUser
userQuery := &models.GetUserByAuthInfoQuery{
- AuthModule: extUser.AuthModule,
- AuthId: extUser.AuthId,
- UserId: extUser.UserId,
- Email: extUser.Email,
- Login: extUser.Login,
+ AuthModule: extUser.AuthModule,
+ AuthId: extUser.AuthId,
+ UserId: extUser.UserId,
+ Email: extUser.Email,
+ Login: extUser.Login,
+ UserSearchParams: cmd.UserSearchParams,
}
if err := bus.Dispatch(userQuery); err != nil {
if !errors.Is(err, models.ErrUserNotFound) {
diff --git a/pkg/services/sqlstore/user_auth.go b/pkg/services/sqlstore/user_auth.go
index 541b9f46e0..b22b1d1b14 100644
--- a/pkg/services/sqlstore/user_auth.go
+++ b/pkg/services/sqlstore/user_auth.go
@@ -34,17 +34,19 @@ func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
authQuery.AuthId = query.AuthId
err = GetAuthInfo(authQuery)
+
if !errors.Is(err, models.ErrUserNotFound) {
if err != nil {
return err
}
// if user id was specified and doesn't match the user_auth entry, remove it
- if query.UserId != 0 && query.UserId != authQuery.Result.UserId {
- err = DeleteAuthInfo(&models.DeleteAuthInfoCommand{
+ if query.UserSearchParams.UserId != nil &&
+ *query.UserSearchParams.UserId != 0 &&
+ *query.UserSearchParams.UserId != authQuery.Result.UserId {
+ if err := DeleteAuthInfo(&models.DeleteAuthInfoCommand{
UserAuth: authQuery.Result,
- })
- if err != nil {
+ }); err != nil {
sqlog.Error("Error removing user_auth entry", "error", err)
}
@@ -71,16 +73,16 @@ func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
}
// If not found, try to find the user by id
- if !has && query.UserId != 0 {
- has, err = x.Id(query.UserId).Get(user)
+ if !has && query.UserSearchParams.UserId != nil && *query.UserSearchParams.UserId != 0 {
+ has, err = x.Id(query.UserSearchParams.UserId).Get(user)
if err != nil {
return err
}
}
// If not found, try to find the user by email address
- if !has && query.Email != "" {
- user = &models.User{Email: query.Email}
+ if !has && query.UserSearchParams.Email != nil && *query.UserSearchParams.Email != "" {
+ user = &models.User{Email: *query.UserSearchParams.Email}
has, err = x.Get(user)
if err != nil {
return err
@@ -88,8 +90,8 @@ func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
}
// If not found, try to find the user by login
- if !has && query.Login != "" {
- user = &models.User{Login: query.Login}
+ if !has && query.UserSearchParams.Login != nil && *query.UserSearchParams.Login != "" {
+ user = &models.User{Login: *query.UserSearchParams.Login}
has, err = x.Get(user)
if err != nil {
return err
diff --git a/pkg/services/sqlstore/user_auth_test.go b/pkg/services/sqlstore/user_auth_test.go
index 7449355ec5..a38fb1894c 100644
--- a/pkg/services/sqlstore/user_auth_test.go
+++ b/pkg/services/sqlstore/user_auth_test.go
@@ -46,7 +46,7 @@ func TestUserAuth(t *testing.T) {
// By Login
login := "loginuser0"
- query := &models.GetUserByAuthInfoQuery{Login: login}
+ query := &models.GetUserByAuthInfoQuery{Login: login, UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -55,7 +55,7 @@ func TestUserAuth(t *testing.T) {
// By ID
id := query.Result.Id
- query = &models.GetUserByAuthInfoQuery{UserId: id}
+ query = &models.GetUserByAuthInfoQuery{UserId: id, UserSearchParams: models.UserSearchParams{UserId: &id}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -64,7 +64,7 @@ func TestUserAuth(t *testing.T) {
// By Email
email := "user1@test.com"
- query = &models.GetUserByAuthInfoQuery{Email: email}
+ query = &models.GetUserByAuthInfoQuery{Email: email, UserSearchParams: models.UserSearchParams{Email: &email}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -73,7 +73,7 @@ func TestUserAuth(t *testing.T) {
// Don't find nonexistent user
email = "nonexistent@test.com"
- query = &models.GetUserByAuthInfoQuery{Email: email}
+ query = &models.GetUserByAuthInfoQuery{Email: email, UserSearchParams: models.UserSearchParams{Email: &email}}
err = GetUserByAuthInfo(query)
So(err, ShouldEqual, models.ErrUserNotFound)
@@ -90,8 +90,8 @@ func TestUserAuth(t *testing.T) {
// create user_auth entry
login := "loginuser0"
-
query.Login = login
+ query.UserSearchParams.Login = &login
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -100,14 +100,14 @@ func TestUserAuth(t *testing.T) {
// get via user_auth
query = &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test"}
err = GetUserByAuthInfo(query)
-
So(err, ShouldBeNil)
So(query.Result.Login, ShouldEqual, login)
// get with non-matching id
id := query.Result.Id
-
- query.UserId = id + 1
+ newId := id + 1
+ query.UserId = newId
+ query.UserSearchParams.UserId = &newId
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -144,7 +144,7 @@ func TestUserAuth(t *testing.T) {
login := "loginuser0"
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test", AuthId: "test"}
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -179,7 +179,7 @@ func TestUserAuth(t *testing.T) {
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test1", AuthId: "test1"}
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "test1", AuthId: "test1", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
getTime = time.Now
@@ -189,7 +189,7 @@ func TestUserAuth(t *testing.T) {
// Add a second auth module for this user
// Have this module's last log-in be more recent
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
- query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test2", AuthId: "test2"}
+ query = &models.GetUserByAuthInfoQuery{AuthModule: "test2", AuthId: "test2", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
getTime = time.Now
diff --git a/pkg/services/sqlstore/user_test.go b/pkg/services/sqlstore/user_test.go
index 353d050ce1..1cd0bd91bc 100644
--- a/pkg/services/sqlstore/user_test.go
+++ b/pkg/services/sqlstore/user_test.go
@@ -456,7 +456,7 @@ func TestUserDataAccess(t *testing.T) {
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: "ldap0"}
+ query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: "ldap0", UserSearchParams: models.UserSearchParams{Login: &login}}
err := GetUserByAuthInfo(query)
getTime = time.Now
@@ -466,7 +466,7 @@ func TestUserDataAccess(t *testing.T) {
// Add a second auth module for this user
// Have this module's last log-in be more recent
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
- query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
+ query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
getTime = time.Now
@@ -512,7 +512,7 @@ func TestUserDataAccess(t *testing.T) {
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: fmt.Sprint("ldap", i)}
+ query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: fmt.Sprint("ldap", i), UserSearchParams: models.UserSearchParams{Login: &login}}
err := GetUserByAuthInfo(query)
getTime = time.Now
@@ -523,7 +523,7 @@ func TestUserDataAccess(t *testing.T) {
// Log in first user with oauth
login := "loginuser0"
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
+ query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0", UserSearchParams: models.UserSearchParams{Login: &login}}
err := GetUserByAuthInfo(query)
getTime = time.Now
Loading