summaryrefslogtreecommitdiff
path: root/config
diff options
context:
space:
mode:
authorMayra Cabrera <mcabrera@gitlab.com>2019-07-09 03:58:49 +0000
committerStan Hu <stanhu@gmail.com>2019-07-09 03:58:49 +0000
commitbcd813c0958b10a9b87e162a85a434255002e027 (patch)
tree83fe697d765c50730120fab889c5ab2b5e90b134 /config
parent735f360cb4d11c9640d66fd8f76dbaf41dd340b7 (diff)
downloadgitlab-ce-bcd813c0958b10a9b87e162a85a434255002e027.tar.gz
Limit user information to RackAttack throttles
rack.attack.match_discriminator is only return on throttle_authenticated_api or throttle_authenticated_web requests, so we're avoiding logging user_id on blacklist requests Follow up of https://gitlab.com/gitlab-org/gitlab-ce/issues/62756
Diffstat (limited to 'config')
-rw-r--r--config/initializers/rack_attack_logging.rb2
1 files changed, 1 insertions, 1 deletions
diff --git a/config/initializers/rack_attack_logging.rb b/config/initializers/rack_attack_logging.rb
index 338e968cc6c..7eb34bd69e5 100644
--- a/config/initializers/rack_attack_logging.rb
+++ b/config/initializers/rack_attack_logging.rb
@@ -12,7 +12,7 @@ ActiveSupport::Notifications.subscribe('rack.attack') do |name, start, finish, r
fullpath: req.fullpath
}
- if req.env['rack.attack.matched'] != 'throttle_unauthenticated'
+ if %w(throttle_authenticated_api throttle_authenticated_web).include? req.env['rack.attack.matched']
user_id = req.env['rack.attack.match_discriminator']
user = User.find_by(id: user_id)