diff options
Diffstat (limited to 'app/controllers/jira_connect')
| -rw-r--r-- | app/controllers/jira_connect/application_controller.rb | 2 | ||||
| -rw-r--r-- | app/controllers/jira_connect/events_controller.rb | 4 | ||||
| -rw-r--r-- | app/controllers/jira_connect/subscriptions_controller.rb | 4 |
3 files changed, 5 insertions, 5 deletions
diff --git a/app/controllers/jira_connect/application_controller.rb b/app/controllers/jira_connect/application_controller.rb index 352e78d6255..9b3bff062dd 100644 --- a/app/controllers/jira_connect/application_controller.rb +++ b/app/controllers/jira_connect/application_controller.rb @@ -22,6 +22,8 @@ class JiraConnect::ApplicationController < ApplicationController def verify_qsh_claim! payload, _ = decode_auth_token! + return if request.format.json? && payload['qsh'] == 'context-qsh' + # Make sure `qsh` claim matches the current request render_403 unless payload['qsh'] == Atlassian::Jwt.create_query_string_hash(request.url, request.method, jira_connect_base_url) rescue StandardError diff --git a/app/controllers/jira_connect/events_controller.rb b/app/controllers/jira_connect/events_controller.rb index 327192857f6..3c78f63e069 100644 --- a/app/controllers/jira_connect/events_controller.rb +++ b/app/controllers/jira_connect/events_controller.rb @@ -7,10 +7,6 @@ class JiraConnect::EventsController < JiraConnect::ApplicationController before_action :verify_asymmetric_atlassian_jwt! def installed - unless Feature.enabled?(:jira_connect_installation_update, default_enabled: :yaml) - return head :ok if current_jira_installation - end - success = current_jira_installation ? update_installation : create_installation if success diff --git a/app/controllers/jira_connect/subscriptions_controller.rb b/app/controllers/jira_connect/subscriptions_controller.rb index ec6ba07a125..d8ce67d6267 100644 --- a/app/controllers/jira_connect/subscriptions_controller.rb +++ b/app/controllers/jira_connect/subscriptions_controller.rb @@ -11,7 +11,9 @@ class JiraConnect::SubscriptionsController < JiraConnect::ApplicationController style_src_values = Array.wrap(p.directives['style-src']) | %w('self' 'unsafe-inline') # rubocop: enable Lint/PercentStringArray - p.frame_ancestors :self, 'https://*.atlassian.net' + # *.jira.com is needed for some legacy Jira Cloud instances, new ones will use *.atlassian.net + # https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/ + p.frame_ancestors :self, 'https://*.atlassian.net', 'https://*.jira.com' p.script_src(*script_src_values) p.style_src(*style_src_values) end |