kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Limit user information to RackAttack throttles

Browse source 
rack.attack.match_discriminator is only return on
throttle_authenticated_api or throttle_authenticated_web requests, so
we're avoiding logging user_id on blacklist requests

Follow up of https://gitlab.com/gitlab-org/gitlab-ce/issues/62756
This commit is contained in:
Mayra Cabrera 2019-07-09 03:58:49 +00:00 committed by Stan Hu
parent 735f360cb4
commit bcd813c095
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
config/initializers/rack_attack_logging.rb
View file

@ -12,7 +12,7 @@ ActiveSupport::Notifications.subscribe('rack.attack') do |name, start, finish, r
fullpath: req.fullpath
}
if req.env['rack.attack.matched'] != 'throttle_unauthenticated'
if %w(throttle_authenticated_api throttle_authenticated_web).include? req.env['rack.attack.matched']
user_id = req.env['rack.attack.match_discriminator']
user = User.find_by(id: user_id)