diff options
author | Alexis Reigel <mail@koffeinfrei.org> | 2017-05-23 16:59:33 +0300 |
---|---|---|
committer | Alexis Reigel <mail@koffeinfrei.org> | 2017-05-24 23:29:59 +0300 |
commit | 6efe9c2f14a5d9d324931ae9e86f9d4e3356f256 (patch) | |
tree | 817b6c4b514c91a8ba1a54052cc4a0d2c1476a69 /app/controllers | |
parent | c1b5c8069e18f76313925d7a7a267cb203d51f9d (diff) |
atom links with rss token instead of private token
Diffstat (limited to 'app/controllers')
-rw-r--r-- | app/controllers/application_controller.rb | 32 |
1 files changed, 25 insertions, 7 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 8ce9150e4a9..ab5aed24917 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -11,6 +11,7 @@ class ApplicationController < ActionController::Base include EnforcesTwoFactorAuthentication before_action :authenticate_user_from_private_token! + before_action :authenticate_user_from_rss_token! before_action :authenticate_user! before_action :validate_user_service_ticket! before_action :check_password_expiration @@ -72,13 +73,20 @@ class ApplicationController < ActionController::Base user = User.find_by_authentication_token(token) || User.find_by_personal_access_token(token) - if user && can?(user, :log_in) - # Notice we are passing store false, so the user is not - # actually stored in the session and a token is needed - # for every request. If you want the token to work as a - # sign in token, you can simply remove store: false. - sign_in user, store: false - end + sessionless_sign_in(user) + end + + # This filter handles authentication for atom request with an rss_token + def authenticate_user_from_rss_token! + return unless request.format.atom? + + token = params[:rss_token].presence + + return unless token.present? + + user = User.find_by_rss_token(token) + + sessionless_sign_in(user) end def log_exception(exception) @@ -282,4 +290,14 @@ class ApplicationController < ActionController::Base ensure Gitlab::I18n.reset_locale end + + def sessionless_sign_in(user) + if user && can?(user, :log_in) + # Notice we are passing store false, so the user is not + # actually stored in the session and a token is needed + # for every request. If you want the token to work as a + # sign in token, you can simply remove store: false. + sign_in user, store: false + end + end end |