Merge branch 'dont-find-by-token-when-no-token-is-present' into 'master'

Don't try to find a user by personal_access_token if the token is nil

See merge request !10146

2 files changed, 7 insertions, 2 deletions

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index b7ce081a5cd..6a6e335d314 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -64,8 +64,11 @@ class ApplicationController < ActionController::Base
 
   # This filter handles both private tokens and personal access tokens
   def authenticate_user_from_private_token!
-    token_string = params[:private_token].presence || request.headers['PRIVATE-TOKEN'].presence
-    user = User.find_by_authentication_token(token_string) || User.find_by_personal_access_token(token_string)
+    token = params[:private_token].presence || request.headers['PRIVATE-TOKEN'].presence
+
+    return unless token.present?
+
+    user = User.find_by_authentication_token(token) || User.find_by_personal_access_token(token)
 
     if user && can?(user, :log_in)
       # Notice we are passing store false, so the user is not
diff --git a/app/models/user.rb b/app/models/user.rb
index 8c7ad5d5174..5d19d873f43 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -324,6 +324,8 @@ class User < ActiveRecord::Base
     end
 
     def find_by_personal_access_token(token_string)
+      return unless token_string
+
       PersonalAccessTokensFinder.new(state: 'active').find_by(token: token_string)&.user
     end