Nulo/gitea
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Activity

Skip SSPI authentication attempts for /api/internal (#12556) (#12559)

Browse source 
Backport #12556

SSPI fails badly on authentication attempts to /api/internal which
it can never succesfully authenticate.

Fix #11260

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: Lauris BH <lauris@nix.lv>
This commit is contained in:
zeripath 2020-08-22 22:09:14 +01:00 committed by GitHub
parent a687980412
commit 8bf2ee1e02
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/auth/sso/oauth2.go
View file

@ -121,7 +121,7 @@ func (o *OAuth2) VerifyAuthData(ctx *macaron.Context, sess session.Store) *model
return nil return nil
} }
if !isAPIPath(ctx) && !isAttachmentDownload(ctx) { if isInternalPath(ctx) || !isAPIPath(ctx) && !isAttachmentDownload(ctx) {
return nil return nil
} }

5
modules/auth/sso/sso.go
View file

@ -100,6 +100,11 @@ func isAPIPath(ctx *macaron.Context) bool {
return strings.HasPrefix(ctx.Req.URL.Path, "/api/") return strings.HasPrefix(ctx.Req.URL.Path, "/api/")
} }
// isInternalPath returns true if the specified URL is an internal API path
func isInternalPath(ctx *macaron.Context) bool {
return strings.HasPrefix(ctx.Req.URL.Path, "/api/internal/")
}
// isAttachmentDownload check if request is a file download (GET) with URL to an attachment // isAttachmentDownload check if request is a file download (GET) with URL to an attachment
func isAttachmentDownload(ctx *macaron.Context) bool { func isAttachmentDownload(ctx *macaron.Context) bool {
return strings.HasPrefix(ctx.Req.URL.Path, "/attachments/") && ctx.Req.Method == "GET" return strings.HasPrefix(ctx.Req.URL.Path, "/attachments/") && ctx.Req.Method == "GET"

2
modules/auth/sso/sspi_windows.go
View file

@ -148,6 +148,8 @@ func (s *SSPI) shouldAuthenticate(ctx *macaron.Context) (shouldAuth bool) {
} else if ctx.Req.FormValue("auth_with_sspi") == "1" { } else if ctx.Req.FormValue("auth_with_sspi") == "1" {
shouldAuth = true shouldAuth = true
} }
} else if isInternalPath(ctx) {
shouldAuth = false
} else if isAPIPath(ctx) || isAttachmentDownload(ctx) { } else if isAPIPath(ctx) || isAttachmentDownload(ctx) {
shouldAuth = true shouldAuth = true
} }