Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
omnibus-heptapod
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Container Registry
Model registry
Operate
Environments
Monitor
Incidents
Service Desk
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
heptapod
omnibus-heptapod
Merge requests
!101
Omnibus Gitlab 16.2 branching point
Code
Review changes
Check out branch
Download
Patches
Plain diff
Merged
Omnibus Gitlab 16.2 branching point
topic/heptapod/gitlab-16.2
into
branch/heptapod
Overview
0
Commits
104
Pipelines
1
Changes
103
Merged
Georges Racinet
requested to merge
topic/heptapod/gitlab-16.2
into
branch/heptapod
1 year ago
Overview
0
Commits
104
Pipelines
1
Changes
103
Expand
0
0
Merge request reports
Compare
branch/heptapod
branch/heptapod (base)
and
latest version
latest version
54898f53
104 commits,
1 year ago
103 files
+
1661
−
845
Inline
Compare changes
Side-by-side
Inline
Show whitespace changes
Show one file at a time
Files
103
Search (e.g. *.vue) (Ctrl+P)
config/patches/grafana/1-cve-2022-31107-oauth-vulnerability.patch deleted
100644 → 0
+
0
−
329
Options
commit 6997c02b5f36a45760bf6ee273b5379fb1c7bcd6
Author: Ankit Panchal <apanchal@gitlab.com>
Date: Tue Aug 23 15:55:18 2022 +0000
#65 Security fix needed for CVE-2022-31107 - Grafana account takeover via OAuth vulnerability
diff --git a/pkg/api/ldap_debug.go b/pkg/api/ldap_debug.go
index ffb7edbae2..c3525362c9 100644
--- a/pkg/api/ldap_debug.go
+++ b/pkg/api/ldap_debug.go
@@ -215,6 +215,11 @@
func (hs *HTTPServer) PostSyncUserWithLDAP(c *models.ReqContext) response.Respon
ReqContext: c,
ExternalUser: user,
SignupAllowed: hs.Cfg.LDAPAllowSignup,
+ UserSearchParams: models.UserSearchParams{
+ UserId: &query.Result.Id,
+ Email: nil,
+ Login: nil,
+ },
}
err = bus.Dispatch(upsertCmd)
diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go
index 873b4a12a3..fec9ca1cd4 100644
--- a/pkg/api/login_oauth.go
+++ b/pkg/api/login_oauth.go
@@ -250,6 +250,11 @@
func syncUser(
ReqContext: ctx,
ExternalUser: extUser,
SignupAllowed: connect.IsSignupAllowed(),
+ UserSearchParams: models.UserSearchParams{
+ Email: &extUser.Email,
+ UserId: nil,
+ Login: nil,
+ },
}
if err := bus.Dispatch(cmd); err != nil {
return nil, err
diff --git a/pkg/login/ldap_login.go b/pkg/login/ldap_login.go
index 2a5f852d73..65bf7b0805 100644
--- a/pkg/login/ldap_login.go
+++ b/pkg/login/ldap_login.go
@@ -56,6 +56,11 @@
var loginUsingLDAP = func(query *models.LoginUserQuery) (bool, error) {
ReqContext: query.ReqContext,
ExternalUser: externalUser,
SignupAllowed: setting.LDAPAllowSignup,
+ UserSearchParams: models.UserSearchParams{
+ Login: &externalUser.Login,
+ Email: &externalUser.Email,
+ UserId: nil,
+ },
}
err = bus.Dispatch(upsert)
if err != nil {
diff --git a/pkg/models/user_auth.go b/pkg/models/user_auth.go
index 1782c0d3a9..e8c64bca3b 100644
--- a/pkg/models/user_auth.go
+++ b/pkg/models/user_auth.go
@@ -57,6 +57,7 @@
type UpsertUserCommand struct {
ReqContext *ReqContext
ExternalUser *ExternalUserInfo
SignupAllowed bool
+ UserSearchParams
Result *User
}
@@ -98,10 +99,17 @@
type GetUserByAuthInfoQuery struct {
UserId int64
Email string
Login string
+ UserSearchParams
Result *User
}
+type UserSearchParams struct {
+ UserId *int64
+ Email *string
+ Login *string
+}
+
type GetExternalUserInfoByLoginQuery struct {
LoginOrEmail string
diff --git a/pkg/services/contexthandler/authproxy/authproxy.go b/pkg/services/contexthandler/authproxy/authproxy.go
index 63cbda9a4b..3d6b45646d 100644
--- a/pkg/services/contexthandler/authproxy/authproxy.go
+++ b/pkg/services/contexthandler/authproxy/authproxy.go
@@ -246,6 +246,11 @@
func (auth *AuthProxy) LoginViaLDAP() (int64, error) {
ReqContext: auth.ctx,
SignupAllowed: auth.cfg.LDAPAllowSignup,
ExternalUser: extUser,
+ UserSearchParams: models.UserSearchParams{
+ Login: &extUser.Login,
+ Email: &extUser.Email,
+ UserId: nil,
+ },
}
if err := bus.Dispatch(upsert); err != nil {
return 0, err
@@ -288,6 +293,11 @@
func (auth *AuthProxy) LoginViaHeader() (int64, error) {
ReqContext: auth.ctx,
SignupAllowed: auth.cfg.AuthProxyAutoSignUp,
ExternalUser: extUser,
+ UserSearchParams: models.UserSearchParams{
+ UserId: nil,
+ Login: &extUser.Login,
+ Email: &extUser.Email,
+ },
}
err := bus.Dispatch(upsert)
diff --git a/pkg/services/login/login.go b/pkg/services/login/login.go
index 3af945fce1..0269485fe7 100644
--- a/pkg/services/login/login.go
+++ b/pkg/services/login/login.go
@@ -37,11 +37,12 @@
func (ls *LoginService) UpsertUser(cmd *models.UpsertUserCommand) error {
extUser := cmd.ExternalUser
userQuery := &models.GetUserByAuthInfoQuery{
- AuthModule: extUser.AuthModule,
- AuthId: extUser.AuthId,
- UserId: extUser.UserId,
- Email: extUser.Email,
- Login: extUser.Login,
+ AuthModule: extUser.AuthModule,
+ AuthId: extUser.AuthId,
+ UserId: extUser.UserId,
+ Email: extUser.Email,
+ Login: extUser.Login,
+ UserSearchParams: cmd.UserSearchParams,
}
if err := bus.Dispatch(userQuery); err != nil {
if !errors.Is(err, models.ErrUserNotFound) {
diff --git a/pkg/services/sqlstore/user_auth.go b/pkg/services/sqlstore/user_auth.go
index 541b9f46e0..b22b1d1b14 100644
--- a/pkg/services/sqlstore/user_auth.go
+++ b/pkg/services/sqlstore/user_auth.go
@@ -34,17 +34,19 @@
func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
authQuery.AuthId = query.AuthId
err = GetAuthInfo(authQuery)
+
if !errors.Is(err, models.ErrUserNotFound) {
if err != nil {
return err
}
// if user id was specified and doesn't match the user_auth entry, remove it
- if query.UserId != 0 && query.UserId != authQuery.Result.UserId {
- err = DeleteAuthInfo(&models.DeleteAuthInfoCommand{
+ if query.UserSearchParams.UserId != nil &&
+ *query.UserSearchParams.UserId != 0 &&
+ *query.UserSearchParams.UserId != authQuery.Result.UserId {
+ if err := DeleteAuthInfo(&models.DeleteAuthInfoCommand{
UserAuth: authQuery.Result,
- })
- if err != nil {
+ }); err != nil {
sqlog.Error("Error removing user_auth entry", "error", err)
}
@@ -71,16 +73,16 @@
func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
}
// If not found, try to find the user by id
- if !has && query.UserId != 0 {
- has, err = x.Id(query.UserId).Get(user)
+ if !has && query.UserSearchParams.UserId != nil && *query.UserSearchParams.UserId != 0 {
+ has, err = x.Id(query.UserSearchParams.UserId).Get(user)
if err != nil {
return err
}
}
// If not found, try to find the user by email address
- if !has && query.Email != "" {
- user = &models.User{Email: query.Email}
+ if !has && query.UserSearchParams.Email != nil && *query.UserSearchParams.Email != "" {
+ user = &models.User{Email: *query.UserSearchParams.Email}
has, err = x.Get(user)
if err != nil {
return err
@@ -88,8 +90,8 @@
func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
}
// If not found, try to find the user by login
- if !has && query.Login != "" {
- user = &models.User{Login: query.Login}
+ if !has && query.UserSearchParams.Login != nil && *query.UserSearchParams.Login != "" {
+ user = &models.User{Login: *query.UserSearchParams.Login}
has, err = x.Get(user)
if err != nil {
return err
diff --git a/pkg/services/sqlstore/user_auth_test.go b/pkg/services/sqlstore/user_auth_test.go
index 7449355ec5..a38fb1894c 100644
--- a/pkg/services/sqlstore/user_auth_test.go
+++ b/pkg/services/sqlstore/user_auth_test.go
@@ -46,7 +46,7 @@
func TestUserAuth(t *testing.T) {
// By Login
login := "loginuser0"
- query := &models.GetUserByAuthInfoQuery{Login: login}
+ query := &models.GetUserByAuthInfoQuery{Login: login, UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -55,7 +55,7 @@
func TestUserAuth(t *testing.T) {
// By ID
id := query.Result.Id
- query = &models.GetUserByAuthInfoQuery{UserId: id}
+ query = &models.GetUserByAuthInfoQuery{UserId: id, UserSearchParams: models.UserSearchParams{UserId: &id}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -64,7 +64,7 @@
func TestUserAuth(t *testing.T) {
// By Email
email := "user1@test.com"
- query = &models.GetUserByAuthInfoQuery{Email: email}
+ query = &models.GetUserByAuthInfoQuery{Email: email, UserSearchParams: models.UserSearchParams{Email: &email}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -73,7 +73,7 @@
func TestUserAuth(t *testing.T) {
// Don't find nonexistent user
email = "nonexistent@test.com"
- query = &models.GetUserByAuthInfoQuery{Email: email}
+ query = &models.GetUserByAuthInfoQuery{Email: email, UserSearchParams: models.UserSearchParams{Email: &email}}
err = GetUserByAuthInfo(query)
So(err, ShouldEqual, models.ErrUserNotFound)
@@ -90,8 +90,8 @@
func TestUserAuth(t *testing.T) {
// create user_auth entry
login := "loginuser0"
-
query.Login = login
+ query.UserSearchParams.Login = &login
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -100,14 +100,14 @@
func TestUserAuth(t *testing.T) {
// get via user_auth
query = &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test"}
err = GetUserByAuthInfo(query)
-
So(err, ShouldBeNil)
So(query.Result.Login, ShouldEqual, login)
// get with non-matching id
id := query.Result.Id
-
- query.UserId = id + 1
+ newId := id + 1
+ query.UserId = newId
+ query.UserSearchParams.UserId = &newId
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -144,7 +144,7 @@
func TestUserAuth(t *testing.T) {
login := "loginuser0"
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test", AuthId: "test"}
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
So(err, ShouldBeNil)
@@ -179,7 +179,7 @@
func TestUserAuth(t *testing.T) {
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test1", AuthId: "test1"}
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "test1", AuthId: "test1", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
getTime = time.Now
@@ -189,7 +189,7 @@
func TestUserAuth(t *testing.T) {
// Add a second auth module for this user
// Have this module's last log-in be more recent
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
- query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test2", AuthId: "test2"}
+ query = &models.GetUserByAuthInfoQuery{AuthModule: "test2", AuthId: "test2", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
getTime = time.Now
diff --git a/pkg/services/sqlstore/user_test.go b/pkg/services/sqlstore/user_test.go
index 353d050ce1..1cd0bd91bc 100644
--- a/pkg/services/sqlstore/user_test.go
+++ b/pkg/services/sqlstore/user_test.go
@@ -456,7 +456,7 @@
func TestUserDataAccess(t *testing.T) {
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: "ldap0"}
+ query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: "ldap0", UserSearchParams: models.UserSearchParams{Login: &login}}
err := GetUserByAuthInfo(query)
getTime = time.Now
@@ -466,7 +466,7 @@
func TestUserDataAccess(t *testing.T) {
// Add a second auth module for this user
// Have this module's last log-in be more recent
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
- query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
+ query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0", UserSearchParams: models.UserSearchParams{Login: &login}}
err = GetUserByAuthInfo(query)
getTime = time.Now
@@ -512,7 +512,7 @@
func TestUserDataAccess(t *testing.T) {
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: fmt.Sprint("ldap", i)}
+ query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: fmt.Sprint("ldap", i), UserSearchParams: models.UserSearchParams{Login: &login}}
err := GetUserByAuthInfo(query)
getTime = time.Now
@@ -523,7 +523,7 @@
func TestUserDataAccess(t *testing.T) {
// Log in first user with oauth
login := "loginuser0"
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
+ query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0", UserSearchParams: models.UserSearchParams{Login: &login}}
err := GetUserByAuthInfo(query)
getTime = time.Now
Loading