Mirrors/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2026-03-15 17:13:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Enhance token checking (#3842)

Browse Source
This commit is contained in:
Anbraten
2024-06-27 00:08:59 +02:00
committed by GitHub
parent ea8976bf88
commit b8b6efb352
5 changed files with 106 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
server/api/hook.go
View File

@@ -178,7 +178,7 @@ func PostHook(c *gin.Context) {
//
// get the token and verify the hook is authorized
parsedToken, err := token.ParseRequest(c.Request, func(_ *token.Token) (string, error) {
parsedToken, err := token.ParseRequest([]token.Type{token.HookToken}, c.Request, func(_ *token.Token) (string, error) {
return repo.Hash, nil
})
if err != nil {

13
server/router/middleware/session/agent.go
View File

@@ -31,17 +31,14 @@ func AuthorizeAgent(c *gin.Context) {
return
}
parsed, err := token.ParseRequest(c.Request, func(_ *token.Token) (string, error) {
_, err := token.ParseRequest([]token.Type{token.AgentToken}, c.Request, func(_ *token.Token) (string, error) {
return secret, nil
})
switch {
case err != nil:
if err != nil {
c.String(http.StatusInternalServerError, "invalid or empty token. %s", err)
c.Abort()
case parsed.Kind != token.AgentToken:
c.String(http.StatusForbidden, "invalid token. please use an agent token")
c.Abort()
default:
c.Next()
return
}
c.Next()
}

4
server/router/middleware/session/user.go
View File

@@ -43,7 +43,7 @@ func SetUser() gin.HandlerFunc {
return func(c *gin.Context) {
var user *model.User
t, err := token.ParseRequest(c.Request, func(t *token.Token) (string, error) {
t, err := token.ParseRequest([]token.Type{token.UserToken, token.SessToken}, c.Request, func(t *token.Token) (string, error) {
var err error
userID, err := strconv.ParseInt(t.Get("user-id"), 10, 64)
if err != nil {
@@ -58,7 +58,7 @@ func SetUser() gin.HandlerFunc {
// if this is a session token (ie not the API token)
// this means the user is accessing with a web browser,
// so we should implement CSRF protection measures.
if t.Kind == token.SessToken {
if t.Type == token.SessToken {
err = token.CheckCsrf(c.Request, func(_ *token.Token) (string, error) {
return user.Hash, nil
})