diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-04-12 09:08:28 +0300 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-04-12 09:08:28 +0300 |
| commit | 9e10ffebdd7550dc72c1124aa5db2eaa97dd0282 (patch) | |
| tree | afb1a49a220de447b516dace578022b0fce7fe0f /app/controllers/jira_connect | |
| parent | 0190b0f605f7ee9d9047a7949177329a6c20c211 (diff) | |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'app/controllers/jira_connect')
| -rw-r--r-- | app/controllers/jira_connect/application_controller.rb | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/app/controllers/jira_connect/application_controller.rb b/app/controllers/jira_connect/application_controller.rb index 352e78d6255..9b3bff062dd 100644 --- a/app/controllers/jira_connect/application_controller.rb +++ b/app/controllers/jira_connect/application_controller.rb @@ -22,6 +22,8 @@ class JiraConnect::ApplicationController < ApplicationController def verify_qsh_claim! payload, _ = decode_auth_token! + return if request.format.json? && payload['qsh'] == 'context-qsh' + # Make sure `qsh` claim matches the current request render_403 unless payload['qsh'] == Atlassian::Jwt.create_query_string_hash(request.url, request.method, jira_connect_base_url) rescue StandardError |