From 37e09858e8f6dec949f004a933eef8346ddc97d4 Mon Sep 17 00:00:00 2001 From: Dmitriy Zaporozhets Date: Tue, 21 Oct 2014 18:26:40 +0300 Subject: [PATCH 01/14] Fix rake gitlab:ldap:check Signed-off-by: Dmitriy Zaporozhets --- lib/gitlab/ldap/adapter.rb | 6 ++++- lib/tasks/gitlab/check.rake | 44 ++++++++++--------------------------- 2 files changed, 17 insertions(+), 33 deletions(-) diff --git a/lib/gitlab/ldap/adapter.rb b/lib/gitlab/ldap/adapter.rb index c4d0a20d89..256cdb4c2f 100644 --- a/lib/gitlab/ldap/adapter.rb +++ b/lib/gitlab/ldap/adapter.rb @@ -22,7 +22,7 @@ module Gitlab Gitlab::LDAP::Config.new(provider) end - def users(field, value) + def users(field, value, limit = nil) if field.to_sym == :dn options = { base: value, @@ -45,6 +45,10 @@ module Gitlab end end + if limit.present? + options.merge!(size: limit) + end + entries = ldap_search(options).select do |entry| entry.respond_to? config.uid end diff --git a/lib/tasks/gitlab/check.rake b/lib/tasks/gitlab/check.rake index 9ec368254a..707d236068 100644 --- a/lib/tasks/gitlab/check.rake +++ b/lib/tasks/gitlab/check.rake @@ -664,7 +664,7 @@ namespace :gitlab do warn_user_is_not_gitlab start_checking "LDAP" - if ldap_config.enabled + if Gitlab::LDAP::Config.enabled? print_users(args.limit) else puts 'LDAP is disabled in config/gitlab.yml' @@ -675,39 +675,19 @@ namespace :gitlab do def print_users(limit) puts "LDAP users with access to your GitLab server (only showing the first #{limit} results)" - ldap.search(attributes: attributes, filter: filter, size: limit, return_result: false) do |entry| - puts "DN: #{entry.dn}\t#{ldap_config.uid}: #{entry[ldap_config.uid]}" + + servers = Gitlab.config.ldap.servers.keys + + servers.each do |server| + puts "Server: #{server}" + Gitlab::LDAP::Adapter.open("ldap#{server}") do |adapter| + users = adapter.users(adapter.config.uid, '*', 100) + users.each do |user| + puts "\tDN: #{user.dn}\t #{adapter.config.uid}: #{user.uid}" + end + end end end - - def attributes - [ldap_config.uid] - end - - def filter - uid_filter = Net::LDAP::Filter.present?(ldap_config.uid) - if user_filter - Net::LDAP::Filter.join(uid_filter, user_filter) - else - uid_filter - end - end - - def user_filter - if ldap_config['user_filter'] && ldap_config.user_filter.present? - Net::LDAP::Filter.construct(ldap_config.user_filter) - else - nil - end - end - - def ldap - @ldap ||= OmniAuth::LDAP::Adaptor.new(ldap_config).connection - end - - def ldap_config - @ldap_config ||= Gitlab.config.ldap - end end # Helper methods From 4c034142a13c2e82e62b6f27a61e371b463310fb Mon Sep 17 00:00:00 2001 From: Dmitriy Zaporozhets Date: Wed, 22 Oct 2014 11:11:18 +0300 Subject: [PATCH 02/14] Make gitlab ldap check work for old and new syntax Signed-off-by: Dmitriy Zaporozhets --- lib/tasks/gitlab/check.rake | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/tasks/gitlab/check.rake b/lib/tasks/gitlab/check.rake index 707d236068..56e8ff4498 100644 --- a/lib/tasks/gitlab/check.rake +++ b/lib/tasks/gitlab/check.rake @@ -676,11 +676,11 @@ namespace :gitlab do def print_users(limit) puts "LDAP users with access to your GitLab server (only showing the first #{limit} results)" - servers = Gitlab.config.ldap.servers.keys + servers = Gitlab::LDAP::Config.providers servers.each do |server| puts "Server: #{server}" - Gitlab::LDAP::Adapter.open("ldap#{server}") do |adapter| + Gitlab::LDAP::Adapter.open(server) do |adapter| users = adapter.users(adapter.config.uid, '*', 100) users.each do |user| puts "\tDN: #{user.dn}\t #{adapter.config.uid}: #{user.uid}" From ed00ab75214389d108a857a22027f221a6649fbe Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Wed, 22 Oct 2014 12:42:41 +0000 Subject: [PATCH 03/14] Merge branch 'fix-500-login-disabled' into 'master' Fix 500 error on login page if ldap enabled and sign-in disabled Related to gitlab/gitlabhq#1701 See merge request !1209 --- app/views/devise/sessions/new.html.haml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/app/views/devise/sessions/new.html.haml b/app/views/devise/sessions/new.html.haml index b983278744..ca7e9570b4 100644 --- a/app/views/devise/sessions/new.html.haml +++ b/app/views/devise/sessions/new.html.haml @@ -2,22 +2,22 @@ .login-heading %h3 Sign in .login-body - - if ldap_enabled? && gitlab_config.signin_enabled + - if ldap_enabled? %ul.nav.nav-tabs - @ldap_servers.each_with_index do |server, i| - %li{class: (:active if i==0)} + %li{class: (:active if i.zero?)} = link_to server['label'], "#tab-#{server['provider_name']}", 'data-toggle' => 'tab' - %li - = link_to 'Standard', '#tab-signin', 'data-toggle' => 'tab' + - if gitlab_config.signin_enabled + %li + = link_to 'Standard', '#tab-signin', 'data-toggle' => 'tab' .tab-content - - @ldap_servers.each_with_index do |server,i| - %div.tab-pane{id: "tab-#{server['provider_name']}", class: (:active if i==0)} + - @ldap_servers.each_with_index do |server, i| + %div.tab-pane{id: "tab-#{server['provider_name']}", class: (:active if i.zero?)} = render 'devise/sessions/new_ldap', provider: server['provider_name'] - %div#tab-signin.tab-pane - = render 'devise/sessions/new_base' + - if gitlab_config.signin_enabled + %div#tab-signin.tab-pane + = render 'devise/sessions/new_base' - - elsif ldap_enabled? - = render 'devise/sessions/new_ldap', ldap_servers: @ldap_servers - elsif gitlab_config.signin_enabled = render 'devise/sessions/new_base' - else From dd0198da1c288199c09f731e3ed65638e5e39e8d Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Wed, 22 Oct 2014 12:42:41 +0000 Subject: [PATCH 04/14] Merge branch 'fix-500-login-disabled' into 'master' Fix 500 error on login page if ldap enabled and sign-in disabled Related to gitlab/gitlabhq#1701 See merge request !1209 --- app/views/devise/sessions/new.html.haml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/app/views/devise/sessions/new.html.haml b/app/views/devise/sessions/new.html.haml index b983278744..ca7e9570b4 100644 --- a/app/views/devise/sessions/new.html.haml +++ b/app/views/devise/sessions/new.html.haml @@ -2,22 +2,22 @@ .login-heading %h3 Sign in .login-body - - if ldap_enabled? && gitlab_config.signin_enabled + - if ldap_enabled? %ul.nav.nav-tabs - @ldap_servers.each_with_index do |server, i| - %li{class: (:active if i==0)} + %li{class: (:active if i.zero?)} = link_to server['label'], "#tab-#{server['provider_name']}", 'data-toggle' => 'tab' - %li - = link_to 'Standard', '#tab-signin', 'data-toggle' => 'tab' + - if gitlab_config.signin_enabled + %li + = link_to 'Standard', '#tab-signin', 'data-toggle' => 'tab' .tab-content - - @ldap_servers.each_with_index do |server,i| - %div.tab-pane{id: "tab-#{server['provider_name']}", class: (:active if i==0)} + - @ldap_servers.each_with_index do |server, i| + %div.tab-pane{id: "tab-#{server['provider_name']}", class: (:active if i.zero?)} = render 'devise/sessions/new_ldap', provider: server['provider_name'] - %div#tab-signin.tab-pane - = render 'devise/sessions/new_base' + - if gitlab_config.signin_enabled + %div#tab-signin.tab-pane + = render 'devise/sessions/new_base' - - elsif ldap_enabled? - = render 'devise/sessions/new_ldap', ldap_servers: @ldap_servers - elsif gitlab_config.signin_enabled = render 'devise/sessions/new_base' - else From ba76dbc3667c2eb0a1a3687f8b0481e619946d73 Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Wed, 22 Oct 2014 15:42:43 +0200 Subject: [PATCH 05/14] Version 7.4.0. --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 7b65f139cb..ba7f754d0c 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -7.4.0.rc1 +7.4.0 From aae4e3f8a43fb64ebd8dd1ae1479651c8951dec0 Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Wed, 22 Oct 2014 15:46:27 +0200 Subject: [PATCH 06/14] Version 7.4.0-ee. --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index a384a475f5..1172785787 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -7.4.0.rc1-ee +7.4.0-ee From e8da077d4f9b63d7d7157416dbf0dad010ea90bd Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Thu, 23 Oct 2014 14:21:21 +0200 Subject: [PATCH 07/14] Fix LDAP authentication for Git HTTP access Conflicts: CHANGELOG --- CHANGELOG | 3 +++ lib/gitlab/ldap/authentication.rb | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 0529069832..561a23538e 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,6 @@ +v 7.4.1 + - Fix LDAP authentication for Git HTTP access + v 7.4.0 - Refactored membership logic - Improve error reporting on users API (Julien Bianchi) diff --git a/lib/gitlab/ldap/authentication.rb b/lib/gitlab/ldap/authentication.rb index a5944f9698..8af2c74e95 100644 --- a/lib/gitlab/ldap/authentication.rb +++ b/lib/gitlab/ldap/authentication.rb @@ -42,7 +42,7 @@ module Gitlab end def adapter - OmniAuth::LDAP::Adaptor.new(config.options) + OmniAuth::LDAP::Adaptor.new(config.options.symbolize_keys) end def config @@ -68,4 +68,4 @@ module Gitlab end end end -end \ No newline at end of file +end From 5f7906e1635baa1aca12527ac9d9f8e84323e95d Mon Sep 17 00:00:00 2001 From: Valery Sizov Date: Fri, 24 Oct 2014 11:52:52 +0300 Subject: [PATCH 08/14] fix for public snippet --- app/controllers/snippets_controller.rb | 2 +- features/snippets/public_snippets.feature | 5 +++++ features/snippets/snippets.feature | 2 +- features/steps/shared/snippet.rb | 9 +++++++++ features/steps/snippets/public_snippets.rb | 17 +++++++++++++++++ 5 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 features/snippets/public_snippets.feature create mode 100644 features/steps/snippets/public_snippets.rb diff --git a/app/controllers/snippets_controller.rb b/app/controllers/snippets_controller.rb index 30fb4c5552..987694260c 100644 --- a/app/controllers/snippets_controller.rb +++ b/app/controllers/snippets_controller.rb @@ -9,7 +9,7 @@ class SnippetsController < ApplicationController before_filter :set_title - skip_before_filter :authenticate_user!, only: [:index, :user_index] + skip_before_filter :authenticate_user!, only: [:index, :user_index, :show] respond_to :html diff --git a/features/snippets/public_snippets.feature b/features/snippets/public_snippets.feature new file mode 100644 index 0000000000..6964badc41 --- /dev/null +++ b/features/snippets/public_snippets.feature @@ -0,0 +1,5 @@ +Feature: Public snippets + Scenario: Unauthenticated user should see public snippets + Given There is public "Personal snippet one" snippet + And I visit snippet page "Personal snippet one" + Then I should see snippet "Personal snippet one" diff --git a/features/snippets/snippets.feature b/features/snippets/snippets.feature index 4c4e3ee2cf..6e8019c326 100644 --- a/features/snippets/snippets.feature +++ b/features/snippets/snippets.feature @@ -25,4 +25,4 @@ Feature: Snippets Scenario: I destroy "Personal snippet one" Given I visit snippet page "Personal snippet one" And I click link "Destroy" - Then I should not see "Personal snippet one" in snippets + Then I should not see "Personal snippet one" in snippets \ No newline at end of file diff --git a/features/steps/shared/snippet.rb b/features/steps/shared/snippet.rb index 432f32defc..bb596c1620 100644 --- a/features/steps/shared/snippet.rb +++ b/features/steps/shared/snippet.rb @@ -51,4 +51,13 @@ module SharedSnippet visibility_level: Snippet::PUBLIC, author: current_user) end + + step 'There is public "Personal snippet one" snippet' do + create(:personal_snippet, + title: "Personal snippet one", + content: "Test content", + file_name: "snippet.rb", + visibility_level: Snippet::PUBLIC, + author: create(:user)) + end end diff --git a/features/steps/snippets/public_snippets.rb b/features/steps/snippets/public_snippets.rb new file mode 100644 index 0000000000..956aa4a3e7 --- /dev/null +++ b/features/steps/snippets/public_snippets.rb @@ -0,0 +1,17 @@ +class Spinach::Features::PublicSnippets < Spinach::FeatureSteps + include SharedAuthentication + include SharedPaths + include SharedSnippet + + step 'I should see snippet "Personal snippet one"' do + page.should have_no_xpath("//i[@class='public-snippet']") + end + + step 'I visit snippet page "Personal snippet one"' do + visit snippet_path(snippet) + end + + def snippet + @snippet ||= PersonalSnippet.find_by!(title: "Personal snippet one") + end +end From 16a10eb1cd4a5447da9d50b1eba25f020dc8f6b7 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Thu, 23 Oct 2014 22:57:16 +0200 Subject: [PATCH 09/14] Fix LDAP config lookup for provider 'ldap' --- CHANGELOG | 1 + lib/gitlab/ldap/config.rb | 27 ++++++++++++++++----------- spec/lib/gitlab/ldap/config_spec.rb | 16 +++++++++++++++- 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 561a23538e..5a494cccc6 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,6 @@ v 7.4.1 - Fix LDAP authentication for Git HTTP access + - Fix LDAP config lookup for provider 'ldap' v 7.4.0 - Refactored membership logic diff --git a/lib/gitlab/ldap/config.rb b/lib/gitlab/ldap/config.rb index d41bfba9b0..0cb24d0ccc 100644 --- a/lib/gitlab/ldap/config.rb +++ b/lib/gitlab/ldap/config.rb @@ -16,10 +16,23 @@ module Gitlab servers.map {|server| server['provider_name'] } end + def self.valid_provider?(provider) + providers.include?(provider) + end + + def self.invalid_provider(provider) + raise "Unknown provider (#{provider}). Available providers: #{providers}" + end + def initialize(provider) - @provider = provider - invalid_provider unless valid_provider? - @options = config_for(provider) + if self.class.valid_provider?(provider) + @provider = provider + elsif provider == 'ldap' + @provider = self.class.providers.first + else + self.class.invalid_provider(provider) + end + @options = config_for(@provider) # Use @provider, not provider end def enabled? @@ -89,14 +102,6 @@ module Gitlab end end - def valid_provider? - self.class.providers.include?(provider) - end - - def invalid_provider - raise "Unknown provider (#{provider}). Available providers: #{self.class.providers}" - end - def auth_options { auth: { diff --git a/spec/lib/gitlab/ldap/config_spec.rb b/spec/lib/gitlab/ldap/config_spec.rb index 76cc7f95c4..3ebb8aae24 100644 --- a/spec/lib/gitlab/ldap/config_spec.rb +++ b/spec/lib/gitlab/ldap/config_spec.rb @@ -16,5 +16,19 @@ describe Gitlab::LDAP::Config do it "raises an error if a unknow provider is used" do expect{ Gitlab::LDAP::Config.new 'unknown' }.to raise_error end + + context "if 'ldap' is the provider name" do + let(:provider) { 'ldap' } + + context "and 'ldap' is not in defined as a provider" do + before { Gitlab::LDAP::Config.stub(providers: %w{ldapmain}) } + + it "uses the first provider" do + # Fetch the provider_name attribute from 'options' so that we know + # that the 'options' Hash is not empty/nil. + expect(config.options['provider_name']).to eq('ldapmain') + end + end + end end -end \ No newline at end of file +end From d4ae4fe670c75ffbb3974734aafbcdc667e53172 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Fri, 24 Oct 2014 11:25:39 +0200 Subject: [PATCH 10/14] Bump gitlab_git to 7.0.0.rc10 (submodules fix) --- Gemfile | 2 +- Gemfile.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile b/Gemfile index c6be76f4ec..f6f3607cbd 100644 --- a/Gemfile +++ b/Gemfile @@ -31,7 +31,7 @@ gem 'omniauth-shibboleth' # Extracting information from a git repository # Provide access to Gitlab::Git library -gem "gitlab_git", '7.0.0.rc9' +gem "gitlab_git", '7.0.0.rc10' # Ruby/Rack Git Smart-HTTP Server Handler gem 'gitlab-grack', '~> 2.0.0.pre', require: 'grack' diff --git a/Gemfile.lock b/Gemfile.lock index 0e82f14ca9..314884fa36 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -179,7 +179,7 @@ GEM mime-types (~> 1.19) gitlab_emoji (0.0.1.1) emoji (~> 1.0.1) - gitlab_git (7.0.0.rc9) + gitlab_git (7.0.0.rc10) activesupport (~> 4.0) charlock_holmes (~> 0.6) gitlab-linguist (~> 3.0) @@ -624,7 +624,7 @@ DEPENDENCIES gitlab-grack (~> 2.0.0.pre) gitlab-linguist (~> 3.0.0) gitlab_emoji (~> 0.0.1.1) - gitlab_git (= 7.0.0.rc9) + gitlab_git (= 7.0.0.rc10) gitlab_meta (= 7.0) gitlab_omniauth-ldap (= 1.1.0) gollum-lib (~> 3.0.0) From 9712fbcdd366c173e2ec277a617a4e690f6a86e9 Mon Sep 17 00:00:00 2001 From: Valery Sizov Date: Fri, 24 Oct 2014 13:30:04 +0300 Subject: [PATCH 11/14] Bump to 7.4.1 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index ba7f754d0c..815da58b7a 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -7.4.0 +7.4.1 From 4272926f551221600e2bec258110f8e1c3fd32c3 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Fri, 24 Oct 2014 13:58:28 +0200 Subject: [PATCH 12/14] Fix merge conflict in lib/gitlab/ldap/adapter.rb --- lib/gitlab/ldap/adapter.rb | 3 --- 1 file changed, 3 deletions(-) diff --git a/lib/gitlab/ldap/adapter.rb b/lib/gitlab/ldap/adapter.rb index a04084f15b..6db1bc3925 100644 --- a/lib/gitlab/ldap/adapter.rb +++ b/lib/gitlab/ldap/adapter.rb @@ -22,8 +22,6 @@ module Gitlab Gitlab::LDAP::Config.new(provider) end -<<<<<<< HEAD -======= # Get LDAP groups from ou=Groups # # cn - filter groups by name @@ -48,7 +46,6 @@ module Gitlab groups(*args).first end ->>>>>>> 7-4-stable-ee def users(field, value, limit = nil) if field.to_sym == :dn options = { From 6adf3bbd671d3e04689f156f94b7cec46d911090 Mon Sep 17 00:00:00 2001 From: Valery Sizov Date: Fri, 24 Oct 2014 16:22:36 +0300 Subject: [PATCH 13/14] update changelog --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index f438f525ad..6a3f8b8620 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ v 7.4.1 - Fix LDAP authentication for Git HTTP access - Fix LDAP config lookup for provider 'ldap' + - Fix public snippets v 7.4.0 - Refactored membership logic From 526b21c4a9d505ba12a29f08b9e9c96811f84a06 Mon Sep 17 00:00:00 2001 From: Valery Sizov Date: Fri, 24 Oct 2014 19:24:49 +0300 Subject: [PATCH 14/14] internal snippets: fix exposing of title Conflicts: CHANGELOG VERSION --- CHANGELOG | 4 ++++ VERSION | 2 +- app/finders/snippets_finder.rb | 2 ++ spec/finders/snippets_finder_spec.rb | 7 +++++++ 4 files changed, 14 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index 6a3f8b8620..22f1040af4 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,7 +1,11 @@ +v 7.4.2 + - Fix internal snippet exposing for unauthenticated users + v 7.4.1 - Fix LDAP authentication for Git HTTP access - Fix LDAP config lookup for provider 'ldap' - Fix public snippets + - Fix 500 error on projects with nested submodules v 7.4.0 - Refactored membership logic diff --git a/VERSION b/VERSION index 53e27f9ccc..a8524be017 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -7.4.1-ee +7.4.2-ee diff --git a/app/finders/snippets_finder.rb b/app/finders/snippets_finder.rb index b29ab6cf40..4b0c69f2d2 100644 --- a/app/finders/snippets_finder.rb +++ b/app/finders/snippets_finder.rb @@ -29,6 +29,8 @@ class SnippetsFinder def by_user(current_user, user, scope) snippets = user.snippets.fresh.non_expired + return snippets.are_public unless current_user + if user == current_user case scope when 'are_internal' then diff --git a/spec/finders/snippets_finder_spec.rb b/spec/finders/snippets_finder_spec.rb index 5af7696818..c645cbc964 100644 --- a/spec/finders/snippets_finder_spec.rb +++ b/spec/finders/snippets_finder_spec.rb @@ -64,6 +64,13 @@ describe SnippetsFinder do snippets = SnippetsFinder.new.execute(user, filter: :by_user, user: user) snippets.should include(@snippet1, @snippet2, @snippet3) end + + it "returns only public snippets if unauthenticated user" do + snippets = SnippetsFinder.new.execute(nil, filter: :by_user, user: user) + snippets.should include(@snippet3) + snippets.should_not include(@snippet2, @snippet1) + end + end context 'by_project filter' do