BigW Consortium Gitlab
Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
G
gitlab-ce
Project
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Commits
Issue Boards
Open sidebar
Forest Godfrey
gitlab-ce
Commits
e4884d9d
Commit
e4884d9d
authored
Sep 27, 2017
by
Robert Speicher
Committed by
Stan Hu
Oct 15, 2017
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Merge branch 'fix-arbitrary-redirect-vulnerability' into 'security-10-0'
Fix arbitrary redirect location vulnerability See merge request gitlab/gitlabhq!2192
parent
c7b8e61d
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
15 additions
and
10 deletions
+15
-10
application_controller.rb
app/controllers/projects/application_controller.rb
+0
-10
projects_controller.rb
app/controllers/projects_controller.rb
+10
-0
fix-arbitrary-redirect-vulnerability.yml
...elogs/unreleased/fix-arbitrary-redirect-vulnerability.yml
+5
-0
No files found.
app/controllers/projects/application_controller.rb
View file @
e4884d9d
...
@@ -2,7 +2,6 @@ class Projects::ApplicationController < ApplicationController
...
@@ -2,7 +2,6 @@ class Projects::ApplicationController < ApplicationController
include
RoutableActions
include
RoutableActions
skip_before_action
:authenticate_user!
skip_before_action
:authenticate_user!
before_action
:redirect_git_extension
before_action
:project
before_action
:project
before_action
:repository
before_action
:repository
layout
'project'
layout
'project'
...
@@ -11,15 +10,6 @@ class Projects::ApplicationController < ApplicationController
...
@@ -11,15 +10,6 @@ class Projects::ApplicationController < ApplicationController
private
private
def
redirect_git_extension
# Redirect from
# localhost/group/project.git
# to
# localhost/group/project
#
redirect_to
url_for
(
params
.
merge
(
format:
nil
))
if
params
[
:format
]
==
'git'
end
def
project
def
project
return
@project
if
@project
return
@project
if
@project
return
nil
unless
params
[
:project_id
]
||
params
[
:id
]
return
nil
unless
params
[
:project_id
]
||
params
[
:id
]
...
...
app/controllers/projects_controller.rb
View file @
e4884d9d
...
@@ -3,6 +3,7 @@ class ProjectsController < Projects::ApplicationController
...
@@ -3,6 +3,7 @@ class ProjectsController < Projects::ApplicationController
include
ExtractsPath
include
ExtractsPath
before_action
:authenticate_user!
,
except:
[
:index
,
:show
,
:activity
,
:refs
]
before_action
:authenticate_user!
,
except:
[
:index
,
:show
,
:activity
,
:refs
]
before_action
:redirect_git_extension
,
only:
[
:show
]
before_action
:project
,
except:
[
:index
,
:new
,
:create
]
before_action
:project
,
except:
[
:index
,
:new
,
:create
]
before_action
:repository
,
except:
[
:index
,
:new
,
:create
]
before_action
:repository
,
except:
[
:index
,
:new
,
:create
]
before_action
:assign_ref_vars
,
only:
[
:show
],
if: :repo_exists?
before_action
:assign_ref_vars
,
only:
[
:show
],
if: :repo_exists?
...
@@ -400,4 +401,13 @@ class ProjectsController < Projects::ApplicationController
...
@@ -400,4 +401,13 @@ class ProjectsController < Projects::ApplicationController
def
project_export_enabled
def
project_export_enabled
render_404
unless
current_application_settings
.
project_export_enabled?
render_404
unless
current_application_settings
.
project_export_enabled?
end
end
def
redirect_git_extension
# Redirect from
# localhost/group/project.git
# to
# localhost/group/project
#
redirect_to
request
.
original_url
.
sub
(
/\.git\/?\Z/
,
''
)
if
params
[
:format
]
==
'git'
end
end
end
changelogs/unreleased/fix-arbitrary-redirect-vulnerability.yml
0 → 100644
View file @
e4884d9d
---
title
:
Prevent an open redirect on project pages
merge_request
:
author
:
type
:
security
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment