kotovalexarian-likes-gitlab
/
gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'bvl-fix-login-issue-with-ldap-enabled' into 'master' 

Load the sessionscontroller after loading the ldap strategies

Closes #35447

See merge request !13049
This commit is contained in:
Robert Speicher 2017-07-24 22:42:52 +00:00
parent 6536c990f0 fa9adb6599
commit d964816b9f
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/controllers/sessions_controller.rb
View File

@ -5,6 +5,14 @@ class SessionsController < Devise::SessionsController
skip_before_action :check_two_factor_requirement, only: [:destroy]
# Explicitly call protect from forgery before anything else. Otherwise the
# CSFR-token might be cleared before authentication is done. This was the case
# when LDAP was enabled and the `OmniauthCallbacksController` is loaded
#
# *Note:* `prepend: true` is the default for rails4, but this will be changed
# to `prepend: false` in rails5.
protect_from_forgery prepend: true, with: :exception
prepend_before_action :check_initial_setup, only: [:new]
prepend_before_action :authenticate_with_two_factor,
if: :two_factor_enabled?, only: [:create]

5
changelogs/unreleased/bvl-fix-login-issue-with-ldap-enabled.yml Normal file
View File

@ -0,0 +1,5 @@
---
title: Fix cross site request protection when logging in as a regular user when LDAP
is enabled
merge_request: 13049
author: