diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-09-29 12:58:00 +0000 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-09-29 12:58:00 +0000 |
commit | a3adc9bca8f340d1e88fda2e5c5d24326417acc4 (patch) | |
tree | 21066363dbdfe79fd6fb6ea2f80578227b449108 /app/controllers/concerns | |
parent | e0ab280b774e34fcfd6fd031616247714230ca68 (diff) | |
download | gitlab-ce-a3adc9bca8f340d1e88fda2e5c5d24326417acc4.tar.gz |
Add latest changes from gitlab-org/security/gitlab@14-3-stable-ee
Diffstat (limited to 'app/controllers/concerns')
-rw-r--r-- | app/controllers/concerns/impersonation.rb | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/app/controllers/concerns/impersonation.rb b/app/controllers/concerns/impersonation.rb index 0764fbc8eb3..539dd9ad69d 100644 --- a/app/controllers/concerns/impersonation.rb +++ b/app/controllers/concerns/impersonation.rb @@ -3,6 +3,12 @@ module Impersonation include Gitlab::Utils::StrongMemoize + SESSION_KEYS_TO_DELETE = %w( + github_access_token gitea_access_token gitlab_access_token + bitbucket_token bitbucket_refresh_token bitbucket_server_personal_access_token + bulk_import_gitlab_access_token fogbugz_token + ).freeze + def current_user user = super @@ -27,6 +33,7 @@ module Impersonation warden.set_user(impersonator, scope: :user) session[:impersonator_id] = nil + clear_access_token_session_keys! current_user end @@ -39,6 +46,12 @@ module Impersonation Gitlab::AppLogger.info("User #{impersonator.username} has stopped impersonating #{current_user.username}") end + def clear_access_token_session_keys! + access_tokens_keys = session.keys & SESSION_KEYS_TO_DELETE + + access_tokens_keys.each { |key| session.delete(key) } + end + def impersonator strong_memoize(:impersonator) do User.find(session[:impersonator_id]) if session[:impersonator_id] |