Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
李少辉-开发者
gitlab-foss
提交
191bcb4d
G
gitlab-foss
项目概览
李少辉-开发者
/
gitlab-foss
通知
15
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
gitlab-foss
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
191bcb4d
编写于
2月 01, 2017
作者:
R
Robert Speicher
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Don't perform Devise trackable updates on blocked User records
上级
4a925837
变更
11
隐藏空白更改
内联
并排
Showing
11 changed file
with
54 addition
and
76 deletion
+54
-76
app/controllers/application_controller.rb
app/controllers/application_controller.rb
+1
-16
app/controllers/explore/application_controller.rb
app/controllers/explore/application_controller.rb
+1
-1
app/controllers/help_controller.rb
app/controllers/help_controller.rb
+1
-1
app/controllers/koding_controller.rb
app/controllers/koding_controller.rb
+1
-1
app/controllers/projects/uploads_controller.rb
app/controllers/projects/uploads_controller.rb
+2
-2
app/controllers/search_controller.rb
app/controllers/search_controller.rb
+1
-1
app/models/user.rb
app/models/user.rb
+9
-0
changelogs/unreleased/rs-warden-blocked-users.yml
changelogs/unreleased/rs-warden-blocked-users.yml
+4
-0
spec/controllers/projects/uploads_controller_spec.rb
spec/controllers/projects/uploads_controller_spec.rb
+10
-54
spec/factories/users.rb
spec/factories/users.rb
+8
-0
spec/features/login_spec.rb
spec/features/login_spec.rb
+16
-0
未找到文件。
app/controllers/application_controller.rb
浏览文件 @
191bcb4d
...
...
@@ -12,7 +12,6 @@ class ApplicationController < ActionController::Base
before_action
:authenticate_user_from_private_token!
before_action
:authenticate_user!
before_action
:validate_user_service_ticket!
before_action
:reject_blocked!
before_action
:check_password_expiration
before_action
:check_2fa_requirement
before_action
:ldap_security_check
...
...
@@ -87,22 +86,8 @@ class ApplicationController < ActionController::Base
logger
.
error
"
\n
#{
exception
.
class
.
name
}
(
#{
exception
.
message
}
):
\n
#{
application_trace
.
join
}
"
end
def
reject_blocked!
if
current_user
&&
current_user
.
blocked?
sign_out
current_user
flash
[
:alert
]
=
"Your account is blocked. Retry when an admin has unblocked it."
redirect_to
new_user_session_path
end
end
def
after_sign_in_path_for
(
resource
)
if
resource
.
is_a?
(
User
)
&&
resource
.
respond_to?
(
:blocked?
)
&&
resource
.
blocked?
sign_out
resource
flash
[
:alert
]
=
"Your account is blocked. Retry when an admin has unblocked it."
new_user_session_path
else
stored_location_for
(
:redirect
)
||
stored_location_for
(
resource
)
||
root_path
end
stored_location_for
(
:redirect
)
||
stored_location_for
(
resource
)
||
root_path
end
def
after_sign_out_path_for
(
resource
)
...
...
app/controllers/explore/application_controller.rb
浏览文件 @
191bcb4d
class
Explore::ApplicationController
<
ApplicationController
skip_before_action
:authenticate_user!
,
:reject_blocked!
skip_before_action
:authenticate_user!
layout
'explore'
end
app/controllers/help_controller.rb
浏览文件 @
191bcb4d
class
HelpController
<
ApplicationController
skip_before_action
:authenticate_user!
,
:reject_blocked!
skip_before_action
:authenticate_user!
layout
'help'
...
...
app/controllers/koding_controller.rb
浏览文件 @
191bcb4d
class
KodingController
<
ApplicationController
before_action
:check_integration!
,
:authenticate_user!
,
:reject_blocked!
before_action
:check_integration!
layout
'koding'
def
index
...
...
app/controllers/projects/uploads_controller.rb
浏览文件 @
191bcb4d
class
Projects::UploadsController
<
Projects
::
ApplicationController
skip_before_action
:
reject_blocked!
,
:project
,
:repository
,
if:
->
{
action_name
==
'show'
&&
image_or_video?
}
skip_before_action
:
project
,
:repository
,
if:
->
{
action_name
==
'show'
&&
image_or_video?
}
before_action
:authorize_upload_file!
,
only:
[
:create
]
...
...
app/controllers/search_controller.rb
浏览文件 @
191bcb4d
class
SearchController
<
ApplicationController
skip_before_action
:authenticate_user!
,
:reject_blocked!
skip_before_action
:authenticate_user!
include
SearchHelper
...
...
app/models/user.rb
浏览文件 @
191bcb4d
...
...
@@ -167,6 +167,15 @@ class User < ActiveRecord::Base
def
blocked?
true
end
def
active_for_authentication?
false
end
def
inactive_message
"Your account has been blocked. Please contact your GitLab "
\
"administrator if you think this is an error."
end
end
end
...
...
changelogs/unreleased/rs-warden-blocked-users.yml
0 → 100644
浏览文件 @
191bcb4d
---
title
:
Don't perform Devise trackable updates on blocked User records
merge_request
:
8915
author
:
spec/controllers/projects/uploads_controller_spec.rb
浏览文件 @
191bcb4d
...
...
@@ -170,68 +170,24 @@ describe Projects::UploadsController do
project
.
team
<<
[
user
,
:master
]
end
context
"when the
user is blocked
"
do
context
"when the
file exists
"
do
before
do
user
.
block
project
.
team
<<
[
user
,
:master
]
end
context
"when the file exists"
do
before
do
allow_any_instance_of
(
FileUploader
).
to
receive
(
:file
).
and_return
(
jpg
)
allow
(
jpg
).
to
receive
(
:exists?
).
and_return
(
true
)
end
context
"when the file is an image"
do
before
do
allow_any_instance_of
(
FileUploader
).
to
receive
(
:image?
).
and_return
(
true
)
end
it
"responds with status 200"
do
go
expect
(
response
).
to
have_http_status
(
200
)
end
end
context
"when the file is not an image"
do
it
"redirects to the sign in page"
do
go
expect
(
response
).
to
redirect_to
(
new_user_session_path
)
end
end
allow_any_instance_of
(
FileUploader
).
to
receive
(
:file
).
and_return
(
jpg
)
allow
(
jpg
).
to
receive
(
:exists?
).
and_return
(
true
)
end
context
"when the file doesn't exist"
do
it
"redirects to the sign in page"
do
go
it
"responds with status 200"
do
go
expect
(
response
).
to
redirect_to
(
new_user_session_path
)
end
expect
(
response
).
to
have_http_status
(
200
)
end
end
context
"when the user isn't blocked"
do
context
"when the file exists"
do
before
do
allow_any_instance_of
(
FileUploader
).
to
receive
(
:file
).
and_return
(
jpg
)
allow
(
jpg
).
to
receive
(
:exists?
).
and_return
(
true
)
end
it
"responds with status 200"
do
go
expect
(
response
).
to
have_http_status
(
200
)
end
end
context
"when the file doesn't exist"
do
it
"responds with status 404"
do
go
context
"when the file doesn't exist"
do
it
"responds with status 404"
do
go
expect
(
response
).
to
have_http_status
(
404
)
end
expect
(
response
).
to
have_http_status
(
404
)
end
end
end
...
...
spec/factories/users.rb
浏览文件 @
191bcb4d
...
...
@@ -14,6 +14,14 @@ FactoryGirl.define do
admin
true
end
trait
:blocked
do
after
(
:build
)
{
|
user
,
_
|
user
.
block!
}
end
trait
:external
do
external
true
end
trait
:two_factor
do
two_factor_via_otp
end
...
...
spec/features/login_spec.rb
浏览文件 @
191bcb4d
...
...
@@ -32,6 +32,22 @@ feature 'Login', feature: true do
end
end
describe
'with a blocked account'
do
it
'prevents the user from logging in'
do
user
=
create
(
:user
,
:blocked
)
login_with
(
user
)
expect
(
page
).
to
have_content
(
'Your account has been blocked.'
)
end
it
'does not update Devise trackable attributes'
do
user
=
create
(
:user
,
:blocked
)
expect
{
login_with
(
user
)
}.
not_to
change
{
user
.
reload
.
sign_in_count
}
end
end
describe
'with two-factor authentication'
do
def
enter_code
(
code
)
fill_in
'user_otp_attempt'
,
with:
code
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录