diff options
author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-11-14 19:39:51 +0400 |
---|---|---|
committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-11-14 19:39:51 +0400 |
commit | e48313f709e8d99e954a98bc569cfaccd65efa4d (patch) | |
tree | cecc0bd894570b1dd1131164555d0fdd32955f6a /lib/api/helpers.rb | |
parent | b490fded3691615fa78ba6548a227fb663ce7d8e (diff) | |
parent | 3909048279a84fab5e16468d83c45f55db1178c1 (diff) |
Merge branch 'api_token_cast' of /home/git/repositories/gitlab/gitlabhq into 6-2-stablev6.2.4
Diffstat (limited to 'lib/api/helpers.rb')
-rw-r--r-- | lib/api/helpers.rb | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb index edc662eaaab..b0f8d5a6da9 100644 --- a/lib/api/helpers.rb +++ b/lib/api/helpers.rb @@ -6,19 +6,23 @@ module API SUDO_PARAM = :sudo def current_user - @current_user ||= User.find_by_authentication_token(params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER]) + private_token = (params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER]).to_s + @current_user ||= User.find_by_authentication_token(private_token) identifier = sudo_identifier() + # If the sudo is the current user do nothing if (identifier && !(@current_user.id == identifier || @current_user.username == identifier)) render_api_error!('403 Forbidden: Must be admin to use sudo', 403) unless @current_user.is_admin? @current_user = User.by_username_or_id(identifier) not_found!("No user id or username for: #{identifier}") if @current_user.nil? end + @current_user end def sudo_identifier() identifier ||= params[SUDO_PARAM] ||= env[SUDO_HEADER] + # Regex for integers if (!!(identifier =~ /^[0-9]+$/)) identifier.to_i @@ -29,6 +33,7 @@ module API def set_current_user_for_thread Thread.current[:current_user] = current_user + begin yield ensure |