88f2e9615c
To prevent an OAuth2 covert redirect vulnerability, this commit adds and uses an alias for the GitHub and BitBucket OAuth2 callback URLs to the following paths: GitHub: /users/auth/-/import/github Bitbucket: /users/auth/-/import/bitbucket This allows admins to put a more restrictive callback URL in the OAuth2 configuration settings. Instead of https://example.com, admins can now use: https://example.com/users/auth It's possible but not trivial to change Devise and OmniAuth to use a different prefix for callback URLs instead of /users/auth. For now, aliasing the import URLs under the /users/auth namespace should suffice. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56663 |
||
|---|---|---|
| .. | ||
| admin.rb | ||
| api.rb | ||
| ci.rb | ||
| dashboard.rb | ||
| development.rb | ||
| explore.rb | ||
| git_http.rb | ||
| google_api.rb | ||
| group.rb | ||
| help.rb | ||
| import.rb | ||
| instance_statistics.rb | ||
| legacy_builds.rb | ||
| profile.rb | ||
| project.rb | ||
| repository.rb | ||
| sherlock.rb | ||
| sidekiq.rb | ||
| snippets.rb | ||
| uploads.rb | ||
| user.rb | ||
| wiki.rb | ||