Skip to content

Commit 1d8e56e

Browse files
lafrikslafriks
authored
In basic auth check for tokens before call UserSignIn (#5725) (#6083)
* Check first if user/password is a token * In basic auth check if user/password is a token * Remove unnecessary else statement * Changes of fmt
1 parent 57ab65d commit 1d8e56e

File tree

2 files changed

+83
-42
lines changed

2 files changed

+83
-42
lines changed

‎modules/auth/auth.go

Lines changed: 46 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -135,15 +135,56 @@ func SignedInUser(ctx *macaron.Context, sess session.Store) (*models.User, bool)
135135
if len(baHead) > 0 {
136136
auths := strings.Fields(baHead)
137137
if len(auths) == 2 && auths[0] == "Basic" {
138+
var u *models.User
139+
138140
uname, passwd, _ := base.BasicAuthDecode(auths[1])
139141

140-
u, err := models.UserSignIn(uname, passwd)
141-
if err != nil {
142-
if !models.IsErrUserNotExist(err) {
143-
log.Error(4, "UserSignIn: %v", err)
142+
// Check if username or password is a token
143+
isUsernameToken := len(passwd) == 0 || passwd == "x-oauth-basic"
144+
// Assume username is token
145+
authToken := uname
146+
if !isUsernameToken {
147+
// Assume password is token
148+
authToken = passwd
149+
}
150+
token, err := models.GetAccessTokenBySHA(authToken)
151+
if err == nil {
152+
if isUsernameToken {
153+
u, err = models.GetUserByID(token.UID)
154+
if err != nil {
155+
log.Error(4, "GetUserByID: %v", err)
156+
return nil, false
157+
}
158+
} else {
159+
u, err = models.GetUserByName(uname)
160+
if err != nil {
161+
log.Error(4, "GetUserByID: %v", err)
162+
return nil, false
163+
}
164+
if u.ID != token.UID {
165+
return nil, false
166+
}
167+
}
168+
token.UpdatedUnix = util.TimeStampNow()
169+
if err = models.UpdateAccessToken(token); err != nil {
170+
log.Error(4, "UpdateAccessToken: %v", err)
171+
}
172+
} else {
173+
if !models.IsErrAccessTokenNotExist(err) && !models.IsErrAccessTokenEmpty(err) {
174+
log.Error(4, "GetAccessTokenBySha: %v", err)
144175
}
145-
return nil, false
146176
}
177+
178+
if u == nil {
179+
u, err = models.UserSignIn(uname, passwd)
180+
if err != nil {
181+
if !models.IsErrUserNotExist(err) {
182+
log.Error(4, "UserSignIn: %v", err)
183+
}
184+
return nil, false
185+
}
186+
}
187+
147188
ctx.Data["IsApiToken"] = true
148189
return u, true
149190
}

‎routers/repo/http.go

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -113,24 +113,24 @@ func HTTP(ctx *context.Context) {
113113
return
114114
}
115115

116-
authUser, err = models.UserSignIn(authUsername, authPasswd)
117-
if err != nil {
118-
if !models.IsErrUserNotExist(err) {
119-
ctx.ServerError("UserSignIn error: %v", err)
120-
return
121-
}
116+
// Check if username or password is a token
117+
isUsernameToken := len(authPasswd) == 0 || authPasswd == "x-oauth-basic"
118+
// Assume username is token
119+
authToken := authUsername
120+
if !isUsernameToken {
121+
// Assume password is token
122+
authToken = authPasswd
122123
}
123-
124-
if authUser == nil {
125-
isUsernameToken := len(authPasswd) == 0 || authPasswd == "x-oauth-basic"
126-
127-
// Assume username is token
128-
authToken := authUsername
129-
130-
if !isUsernameToken {
131-
// Assume password is token
132-
authToken = authPasswd
133-
124+
// Assume password is a token.
125+
token, err := models.GetAccessTokenBySHA(authToken)
126+
if err == nil {
127+
if isUsernameToken {
128+
authUser, err = models.GetUserByID(token.UID)
129+
if err != nil {
130+
ctx.ServerError("GetUserByID", err)
131+
return
132+
}
133+
} else {
134134
authUser, err = models.GetUserByName(authUsername)
135135
if err != nil {
136136
if models.IsErrUserNotExist(err) {
@@ -140,37 +140,37 @@ func HTTP(ctx *context.Context) {
140140
}
141141
return
142142
}
143-
}
144-
145-
// Assume password is a token.
146-
token, err := models.GetAccessTokenBySHA(authToken)
147-
if err != nil {
148-
if models.IsErrAccessTokenNotExist(err) || models.IsErrAccessTokenEmpty(err) {
143+
if authUser.ID != token.UID {
149144
ctx.HandleText(http.StatusUnauthorized, "invalid credentials")
150-
} else {
151-
ctx.ServerError("GetAccessTokenBySha", err)
145+
return
152146
}
153-
return
154147
}
148+
token.UpdatedUnix = util.TimeStampNow()
149+
if err = models.UpdateAccessToken(token); err != nil {
150+
ctx.ServerError("UpdateAccessToken", err)
151+
}
152+
} else {
153+
if !models.IsErrAccessTokenNotExist(err) && !models.IsErrAccessTokenEmpty(err) {
154+
log.Error(4, "GetAccessTokenBySha: %v", err)
155+
}
156+
}
155157

156-
if isUsernameToken {
157-
authUser, err = models.GetUserByID(token.UID)
158-
if err != nil {
159-
ctx.ServerError("GetUserByID", err)
158+
if authUser == nil {
159+
// Check username and password
160+
authUser, err = models.UserSignIn(authUsername, authPasswd)
161+
if err != nil {
162+
if !models.IsErrUserNotExist(err) {
163+
ctx.ServerError("UserSignIn error: %v", err)
160164
return
161165
}
162-
} else if authUser.ID != token.UID {
166+
}
167+
168+
if authUser == nil {
163169
ctx.HandleText(http.StatusUnauthorized, "invalid credentials")
164170
return
165171
}
166172

167-
token.UpdatedUnix = util.TimeStampNow()
168-
if err = models.UpdateAccessToken(token); err != nil {
169-
ctx.ServerError("UpdateAccessToken", err)
170-
}
171-
} else {
172173
_, err = models.GetTwoFactorByUID(authUser.ID)
173-
174174
if err == nil {
175175
// TODO: This response should be changed to "invalid credentials" for security reasons once the expectation behind it (creating an app token to authenticate) is properly documented
176176
ctx.HandleText(http.StatusUnauthorized, "Users with two-factor authentication enabled cannot perform HTTP/HTTPS operations via plain username and password. Please create and use a personal access token on the user settings page")

0 commit comments

Comments
 (0)