544ef7d394
Backport #15895 Storing these credentials is a liability. * Encrypt credentials with SECRET_KEY before persisting to task queue table (they need to be persisted due to the nature of the task queue) - security in depth: helps when attacker has access to DB only, but not app.ini * Delete all credentials (even encrypted) from the task table, once the migration is done, for safety - security in depth: minimizes leaked data if attacker gains access to snapshot of both DB and app.ini
132 lines
3.4 KiB
Go
132 lines
3.4 KiB
Go
// Copyright 2019 Gitea. All rights reserved.
|
|
// Use of this source code is governed by a MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package task
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"code.gitea.io/gitea/models"
|
|
"code.gitea.io/gitea/modules/graceful"
|
|
"code.gitea.io/gitea/modules/log"
|
|
"code.gitea.io/gitea/modules/migrations/base"
|
|
"code.gitea.io/gitea/modules/queue"
|
|
repo_module "code.gitea.io/gitea/modules/repository"
|
|
"code.gitea.io/gitea/modules/secret"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
"code.gitea.io/gitea/modules/structs"
|
|
"code.gitea.io/gitea/modules/timeutil"
|
|
"code.gitea.io/gitea/modules/util"
|
|
jsoniter "github.com/json-iterator/go"
|
|
)
|
|
|
|
// taskQueue is a global queue of tasks
|
|
var taskQueue queue.Queue
|
|
|
|
// Run a task
|
|
func Run(t *models.Task) error {
|
|
switch t.Type {
|
|
case structs.TaskTypeMigrateRepo:
|
|
return runMigrateTask(t)
|
|
default:
|
|
return fmt.Errorf("Unknown task type: %d", t.Type)
|
|
}
|
|
}
|
|
|
|
// Init will start the service to get all unfinished tasks and run them
|
|
func Init() error {
|
|
taskQueue = queue.CreateQueue("task", handle, &models.Task{})
|
|
|
|
if taskQueue == nil {
|
|
return fmt.Errorf("Unable to create Task Queue")
|
|
}
|
|
|
|
go graceful.GetManager().RunWithShutdownFns(taskQueue.Run)
|
|
|
|
return nil
|
|
}
|
|
|
|
func handle(data ...queue.Data) {
|
|
for _, datum := range data {
|
|
task := datum.(*models.Task)
|
|
if err := Run(task); err != nil {
|
|
log.Error("Run task failed: %v", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// MigrateRepository add migration repository to task
|
|
func MigrateRepository(doer, u *models.User, opts base.MigrateOptions) error {
|
|
task, err := CreateMigrateTask(doer, u, opts)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return taskQueue.Push(task)
|
|
}
|
|
|
|
// CreateMigrateTask creates a migrate task
|
|
func CreateMigrateTask(doer, u *models.User, opts base.MigrateOptions) (*models.Task, error) {
|
|
// encrypt credentials for persistence
|
|
var err error
|
|
opts.CloneAddrEncrypted, err = secret.EncryptSecret(setting.SecretKey, opts.CloneAddr)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
opts.CloneAddr = util.SanitizeURLCredentials(opts.CloneAddr, true)
|
|
opts.AuthPasswordEncrypted, err = secret.EncryptSecret(setting.SecretKey, opts.AuthPassword)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
opts.AuthPassword = ""
|
|
opts.AuthTokenEncrypted, err = secret.EncryptSecret(setting.SecretKey, opts.AuthToken)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
opts.AuthToken = ""
|
|
|
|
json := jsoniter.ConfigCompatibleWithStandardLibrary
|
|
bs, err := json.Marshal(&opts)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var task = models.Task{
|
|
DoerID: doer.ID,
|
|
OwnerID: u.ID,
|
|
Type: structs.TaskTypeMigrateRepo,
|
|
Status: structs.TaskStatusQueue,
|
|
PayloadContent: string(bs),
|
|
}
|
|
|
|
if err := models.CreateTask(&task); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
repo, err := repo_module.CreateRepository(doer, u, models.CreateRepoOptions{
|
|
Name: opts.RepoName,
|
|
Description: opts.Description,
|
|
OriginalURL: opts.OriginalURL,
|
|
GitServiceType: opts.GitServiceType,
|
|
IsPrivate: opts.Private,
|
|
IsMirror: opts.Mirror,
|
|
Status: models.RepositoryBeingMigrated,
|
|
})
|
|
if err != nil {
|
|
task.EndTime = timeutil.TimeStampNow()
|
|
task.Status = structs.TaskStatusFailed
|
|
err2 := task.UpdateCols("end_time", "status")
|
|
if err2 != nil {
|
|
log.Error("UpdateCols Failed: %v", err2.Error())
|
|
}
|
|
return nil, err
|
|
}
|
|
|
|
task.RepoID = repo.ID
|
|
if err = task.UpdateCols("repo_id"); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &task, nil
|
|
}
|