4 files changed, 60 insertions, 6 deletions
diff --git a/app/controllers/import/bulk_imports_controller.rb b/app/controllers/import/bulk_imports_controller.rb
new file mode 100644
index 00000000000..58b9f8c0fbb
--- /dev/null
+++ b/app/controllers/import/bulk_imports_controller.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+class Import::BulkImportsController < ApplicationController
+  before_action :ensure_group_import_enabled
+  before_action :verify_blocked_uri, only: :status
+
+  def configure
+    session[access_token_key] = params[access_token_key]&.strip
+    session[url_key] = params[url_key]
+
+    redirect_to status_import_bulk_import_url
+  end
+
+  private
+
+  def import_params
+    params.permit(access_token_key, url_key)
+  end
+
+  def ensure_group_import_enabled
+    render_404 unless Feature.enabled?(:bulk_import)
+  end
+
+  def access_token_key
+    :bulk_import_gitlab_access_token
+  end
+
+  def url_key
+    :bulk_import_gitlab_url
+  end
+
+  def verify_blocked_uri
+    Gitlab::UrlBlocker.validate!(
+      session[url_key],
+      **{
+        allow_localhost: allow_local_requests?,
+        allow_local_network: allow_local_requests?,
+        schemes: %w(http https)
+      }
+    )
+  rescue Gitlab::UrlBlocker::BlockedUrlError => e
+    session[access_token_key] = nil
+    session[url_key] = nil
+
+    redirect_to new_group_path, alert: _('Specified URL cannot be used: "%{reason}"') % { reason: e.message }
+  end
+
+  def allow_local_requests?
+    Gitlab::CurrentSettings.allow_local_requests_from_web_hooks_and_services?
+  end
+end
diff --git a/app/controllers/import/fogbugz_controller.rb b/app/controllers/import/fogbugz_controller.rb
index a34bc9c953f..bcbf5938e11 100644
--- a/app/controllers/import/fogbugz_controller.rb
+++ b/app/controllers/import/fogbugz_controller.rb
@@ -136,7 +136,7 @@ class Import::FogbugzController < Import::BaseController
   def verify_blocked_uri
     Gitlab::UrlBlocker.validate!(
       params[:uri],
-      {
+      **{
         allow_localhost: allow_local_requests?,
         allow_local_network: allow_local_requests?,
         schemes: %w(http https)
diff --git a/app/controllers/import/github_controller.rb b/app/controllers/import/github_controller.rb
index 29fe34f0734..a1adc6e062a 100644
--- a/app/controllers/import/github_controller.rb
+++ b/app/controllers/import/github_controller.rb
@@ -108,7 +108,7 @@ class Import::GithubController < Import::BaseController
     @client ||= if Feature.enabled?(:remove_legacy_github_client)
                   Gitlab::GithubImport::Client.new(session[access_token_key])
                 else
-                  Gitlab::LegacyGithubImport::Client.new(session[access_token_key], client_options)
+                  Gitlab::LegacyGithubImport::Client.new(session[access_token_key], **client_options)
                 end
   end
 
diff --git a/app/controllers/import/manifest_controller.rb b/app/controllers/import/manifest_controller.rb
index 9c47e6d4b0b..fdca6da95c5 100644
--- a/app/controllers/import/manifest_controller.rb
+++ b/app/controllers/import/manifest_controller.rb
@@ -26,8 +26,7 @@ class Import::ManifestController < Import::BaseController
     manifest = Gitlab::ManifestImport::Manifest.new(params[:manifest].tempfile)
 
     if manifest.valid?
-      session[:manifest_import_repositories] = manifest.projects
-      session[:manifest_import_group_id] = group.id
+      manifest_import_metadata.save(manifest.projects, group.id)
 
       redirect_to status_import_manifest_path
     else
@@ -96,12 +95,16 @@ class Import::ManifestController < Import::BaseController
 
   # rubocop: disable CodeReuse/ActiveRecord
   def group
-    @group ||= Group.find_by(id: session[:manifest_import_group_id])
+    @group ||= Group.find_by(id: manifest_import_metadata.group_id)
   end
   # rubocop: enable CodeReuse/ActiveRecord
 
+  def manifest_import_metadata
+    @manifest_import_status ||= Gitlab::ManifestImport::Metadata.new(current_user, fallback: session)
+  end
+
   def repositories
-    @repositories ||= session[:manifest_import_repositories]
+    @repositories ||= manifest_import_metadata.repositories
   end
 
   def find_jobs