Merge branch 'stanhu/gitlab-ce-support-token-retrieval-by-headers' into 'master'

Support download access by PRIVATE-TOKEN header Originally opened at !2522. Currently there is no way to download a raw file without embedding the token in the URL, which exposes the token in the URL. There should be an way of sending this information via the header as the API does. Closes https://github.com/gitlabhq/gitlabhq/issues/8137 See merge request !2683

Merge branch 'stanhu/gitlab-ce-support-token-retrieval-by-headers' into 'master'
259c0d02 · Dmitriy Zaporozhets · bb51e9c6 · 7aa739dd · 259c0d02 · 259c0d02
Commit 259c0d02 authored Feb 03, 2016 by Dmitriy Zaporozhets
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

CHANGELOG CHANGELOG +1 -0

application_controller.rb app/controllers/application_controller.rb +2 -0

No files found.
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -6,6 +6,7 @@ v 8.5.0 (unreleased)
  - Add "visibility" flag to GET /projects api endpoint
  - Ignore binary files in code search to prevent Error 500 (Stan Hu)
  - Render sanitized SVG images (Stan Hu)
+  - Support download access by PRIVATE-TOKEN header (Stan Hu)
  - Upgrade gitlab_git to 7.2.23 to fix commit message mentions in first branch push
  - New UI for pagination
  - Don't prevent sign out when 2FA enforcement is enabled and user hasn't yet

--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -60,6 +60,8 @@ class ApplicationController < ActionController::Base
                   params[:authenticity_token].presence
                 elsif params[:private_token].presence
                   params[:private_token].presence
+                 elsif request.headers['PRIVATE-TOKEN'].present?
+                   request.headers['PRIVATE-TOKEN']
                 end
    user = user_token && User.find_by_authentication_token(user_token.to_s)