git_http_client_controller.rb 3 KB
Newer Older
Jacob Vosmaer's avatar
Jacob Vosmaer committed
1 2 3 4 5 6
# This file should be identical in GitLab Community Edition and Enterprise Edition

class Projects::GitHttpClientController < Projects::ApplicationController
  include ActionController::HttpAuthentication::Basic
  include KerberosSpnegoHelper

7
  attr_reader :authentication_result, :redirected_path
8 9 10 11

  delegate :actor, :authentication_abilities, to: :authentication_result, allow_nil: true

  alias_method :user, :actor
12
  alias_method :authenticated_user, :actor
Jacob Vosmaer's avatar
Jacob Vosmaer committed
13 14 15 16 17 18 19 20

  # Git clients will not know what authenticity token to send along
  skip_before_action :verify_authenticity_token
  skip_before_action :repository
  before_action :authenticate_user

  private

21 22 23 24 25 26 27 28
  def download_request?
    raise NotImplementedError
  end

  def upload_request?
    raise NotImplementedError
  end

Jacob Vosmaer's avatar
Jacob Vosmaer committed
29
  def authenticate_user
30 31
    @authentication_result = Gitlab::Auth::Result.new

Jacob Vosmaer's avatar
Jacob Vosmaer committed
32 33
    if allow_basic_auth? && basic_auth_provided?
      login, password = user_name_and_password(request)
34

35
      if handle_basic_authentication(login, password)
Jacob Vosmaer's avatar
Jacob Vosmaer committed
36 37 38
        return # Allow access
      end
    elsif allow_kerberos_spnego_auth? && spnego_provided?
39
      kerberos_user = find_kerberos_user
40

41
      if kerberos_user
42
        @authentication_result = Gitlab::Auth::Result.new(
43
          kerberos_user, nil, :kerberos, Gitlab::Auth.full_authentication_abilities)
Jacob Vosmaer's avatar
Jacob Vosmaer committed
44 45 46 47

        send_final_spnego_response
        return # Allow access
      end
48 49 50 51
    elsif project && download_request? && Guest.can?(:download_code, project)
      @authentication_result = Gitlab::Auth::Result.new(nil, project, :none, [:download_code])

      return # Allow access
Jacob Vosmaer's avatar
Jacob Vosmaer committed
52 53 54 55
    end

    send_challenges
    render plain: "HTTP Basic: Access denied\n", status: 401
56 57
  rescue Gitlab::Auth::MissingPersonalAccessTokenError
    render_missing_personal_access_token
Jacob Vosmaer's avatar
Jacob Vosmaer committed
58 59 60 61 62 63 64 65 66 67 68 69 70 71
  end

  def basic_auth_provided?
    has_basic_credentials?(request)
  end

  def send_challenges
    challenges = []
    challenges << 'Basic realm="GitLab"' if allow_basic_auth?
    challenges << spnego_challenge if allow_kerberos_spnego_auth?
    headers['Www-Authenticate'] = challenges.join("\n") if challenges.any?
  end

  def project
72
    parse_repo_path unless defined?(@project)
Jacob Vosmaer's avatar
Jacob Vosmaer committed
73

74 75
    @project
  end
Jacob Vosmaer's avatar
Jacob Vosmaer committed
76

77 78
  def parse_repo_path
    @project, @wiki, @redirected_path = Gitlab::RepoPath.parse("#{params[:namespace_id]}/#{params[:project_id]}")
Jacob Vosmaer's avatar
Jacob Vosmaer committed
79 80
  end

81
  def render_missing_personal_access_token
82
    render plain: "HTTP Basic: Access denied\n" \
83
                  "You must use a personal access token with 'api' scope for Git over HTTP.\n" \
84 85
                  "You can generate one at #{profile_personal_access_tokens_url}",
           status: 401
86 87
  end

Jacob Vosmaer's avatar
Jacob Vosmaer committed
88
  def repository
89 90 91 92
    wiki? ? project.wiki.repository : project.repository
  end

  def wiki?
93
    parse_repo_path unless defined?(@wiki)
Jacob Vosmaer's avatar
Jacob Vosmaer committed
94

95
    @wiki
Jacob Vosmaer's avatar
Jacob Vosmaer committed
96 97
  end

98 99 100
  def handle_basic_authentication(login, password)
    @authentication_result = Gitlab::Auth.find_for_git_client(
      login, password, project: project, ip: request.ip)
101

102
    @authentication_result.success?
103 104
  end

105
  def ci?
106
    authentication_result.ci?(project)
107
  end
Jacob Vosmaer's avatar
Jacob Vosmaer committed
108
end