• Stan Hu's avatar
    Alias GitHub and BitBucket OAuth2 callback URLs · 6d57b2fd
    Stan Hu authored
    To prevent an OAuth2 covert redirect vulnerability, this commit adds and
    uses an alias for the GitHub and BitBucket OAuth2 callback URLs to the
    following paths:
    
    GitHub: /users/auth/-/import/github
    Bitbucket: /users/auth/-/import/bitbucket
    
    This allows admins to put a more restrictive callback URL in the OAuth2
    configuration settings. Instead of https://example.com, admins can now use:
    
    https://example.com/users/auth
    
    It's possible but not trivial to change Devise and OmniAuth to use a
    different prefix for callback URLs instead of /users/auth. For now,
    aliasing the import URLs under the /users/auth namespace should suffice.
    
    Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56663
    6d57b2fd
Name
Last commit
Last update
..
admin.rb Loading commit data...
api.rb Loading commit data...
ci.rb Loading commit data...
dashboard.rb Loading commit data...
development.rb Loading commit data...
explore.rb Loading commit data...
git_http.rb Loading commit data...
google_api.rb Loading commit data...
group.rb Loading commit data...
help.rb Loading commit data...
import.rb Loading commit data...
instance_statistics.rb Loading commit data...
legacy_builds.rb Loading commit data...
profile.rb Loading commit data...
project.rb Loading commit data...
repository.rb Loading commit data...
sherlock.rb Loading commit data...
sidekiq.rb Loading commit data...
snippets.rb Loading commit data...
uploads.rb Loading commit data...
user.rb Loading commit data...
wiki.rb Loading commit data...