3692e9f8a2
If the request wasn't initiated by gitlab we shouldn't add the new identity to the user, and instead show that we weren't able to link the identity to the user. This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509
34 lines
778 B
Ruby
34 lines
778 B
Ruby
# frozen_string_literal: true
|
|
|
|
module Gitlab
|
|
module Auth
|
|
module Saml
|
|
class IdentityLinker < OmniauthIdentityLinkerBase
|
|
extend ::Gitlab::Utils::Override
|
|
|
|
UnverifiedRequest = Class.new(StandardError)
|
|
|
|
override :link
|
|
def link
|
|
raise_unless_request_is_gitlab_initiated! if unlinked?
|
|
|
|
super
|
|
end
|
|
|
|
protected
|
|
|
|
def raise_unless_request_is_gitlab_initiated!
|
|
raise UnverifiedRequest unless valid_gitlab_initiated_request?
|
|
end
|
|
|
|
def valid_gitlab_initiated_request?
|
|
OriginValidator.new(session).gitlab_initiated?(saml_response)
|
|
end
|
|
|
|
def saml_response
|
|
oauth.fetch(:extra, {}).fetch(:response_object, {})
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|