diff options
| author | James Lopez <james@gitlab.com> | 2018-03-15 18:01:13 +0300 |
|---|---|---|
| committer | Mark Fletcher <mark@gitlab.com> | 2018-03-21 17:43:47 +0300 |
| commit | 140cb0c092151636463a2222ce3fc2267f621d3a (patch) | |
| tree | a1338289fd405b9e617ed7e01728b086be820da6 /app/controllers/omniauth_callbacks_controller.rb | |
| parent | 95ced3bb5fa52e166aa03ee592f63180601cbde7 (diff) | |
Merge branch 'fix/auth0-unsafe-login-10-6' into 'security-10-6'
[10.6] Fix GitLab Auth0 integration signs in the wrong user
See merge request gitlab/gitlabhq!2354
Diffstat (limited to 'app/controllers/omniauth_callbacks_controller.rb')
| -rw-r--r-- | app/controllers/omniauth_callbacks_controller.rb | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/app/controllers/omniauth_callbacks_controller.rb b/app/controllers/omniauth_callbacks_controller.rb index 8440945ab43..fff249577a2 100644 --- a/app/controllers/omniauth_callbacks_controller.rb +++ b/app/controllers/omniauth_callbacks_controller.rb @@ -95,6 +95,14 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController handle_omniauth end + def auth0 + if oauth['uid'].blank? + fail_auth0_login + else + handle_omniauth + end + end + private def handle_omniauth @@ -170,6 +178,12 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController redirect_to new_user_session_path end + def fail_auth0_login + flash[:alert] = 'Wrong extern UID provided. Make sure Auth0 is configured correctly.' + + redirect_to new_user_session_path + end + def handle_disabled_provider label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider']) flash[:alert] = "Signing in using #{label} has been disabled" |