Download as
Browse Code »

Commit f18a714f357405a87031250f4350343ae54d528f

Authored by Dmitriy Zaporozhets
1 parent 19c28822
Exists in spb-stable and in 3 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb

Use GitAccess in internal api 

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Showing 1 changed file with 19 additions and 41 deletions   Show diff stats
lib/api/internal.rb
  Diff comments   View file @f18a714
1 1 module API
2 2 # Internal access API
3 3 class Internal < Grape::API
4   -
5   - DOWNLOAD_COMMANDS = %w{ git-upload-pack git-upload-archive }
6   - PUSH_COMMANDS = %w{ git-receive-pack }
7   -
8 4 namespace 'internal' do
9   - #
10   - # Check if ssh key has access to project code
  5 + # Check if git command is allowed to project
11 6 #
12 7 # Params:
13   - # key_id - SSH Key id
  8 + # key_id - ssh key id for Git over SSH
  9 + # user_id - user id for Git over HTTP
14 10 # project - project path with namespace
15 11 # action - git action (git-upload-pack or git-receive-pack)
16 12 # ref - branch name
... ... @@ -22,43 +18,25 @@ module API
22 18 # the wiki repository as well.
23 19 project_path = params[:project]
24 20 project_path.gsub!(/\.wiki/,'') if project_path =~ /\.wiki/
25   -
26   - key = Key.find(params[:key_id])
27 21 project = Project.find_with_namespace(project_path)
28   - git_cmd = params[:action]
29 22 return false unless project
30 23  
31   -
32   - if key.is_a? DeployKey
33   - key.projects.include?(project) && DOWNLOAD_COMMANDS.include?(git_cmd)
34   - else
35   - user = key.user
36   -
37   - return false if user.blocked?
38   -
39   - if Gitlab.config.ldap.enabled
40   - if user.ldap_user?
41   - # Check if LDAP user exists and match LDAP user_filter
42   - unless Gitlab::LDAP::Access.new.allowed?(user)
43   - return false
44   - end
45   - end
46   - end
47   -
48   - action = case git_cmd
49   - when *DOWNLOAD_COMMANDS
50   - then :download_code
51   - when *PUSH_COMMANDS
52   - then
53   - if project.protected_branch?(params[:ref])
54   - :push_code_to_protected_branches
55   - else
56   - :push_code
57   - end
58   - end
59   -
60   - user.can?(action, project)
61   - end
  24 + actor = if params[:key_id]
  25 + Key.find(params[:key_id])
  26 + elsif params[:user_id]
  27 + User.find(params[:user_id])
  28 + end
  29 +
  30 + return false unless actor
  31 +
  32 + Gitlab::GitAccess.new.allowed?(
  33 + actor,
  34 + params[:action],
  35 + project,
  36 + params[:ref],
  37 + params[:oldrev],
  38 + params[:newrev]
  39 + )
62 40 end
63 41  
64 42 #
... ...