root
/
gitlab-ce
mirror of https://gitlab.com/free-releases/gitlab-ce.git
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Make sure private_token for API is a string 

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
This commit is contained in:
Dmitriy Zaporozhets 2013-11-08 18:49:38 +02:00
parent dfade97edf
commit 9d79d6e152
No known key found for this signature in database
GPG Key ID: 2CEAFD2671262EC2
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/api/helpers.rb
View File

@ -6,19 +6,23 @@ module API
SUDO_PARAM = :sudo
def current_user
@current_user ||= User.find_by_authentication_token(params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER])
private_token = (params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER]).to_s
@current_user ||= User.find_by_authentication_token(private_token)
identifier = sudo_identifier()
# If the sudo is the current user do nothing
if (identifier && !(@current_user.id == identifier || @current_user.username == identifier))
render_api_error!('403 Forbidden: Must be admin to use sudo', 403) unless @current_user.is_admin?
@current_user = User.by_username_or_id(identifier)
not_found!("No user id or username for: #{identifier}") if @current_user.nil?
end
@current_user
end
def sudo_identifier()
identifier ||= params[SUDO_PARAM] ||= env[SUDO_HEADER]
# Regex for integers
if (!!(identifier =~ /^[0-9]+$/))
identifier.to_i
@ -29,6 +33,7 @@ module API
def set_current_user_for_thread
Thread.current[:current_user] = current_user
begin
yield
ensure