From a986819a7bce2002018dfafed3900dc3f2e8fb81 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Tue, 1 Sep 2020 16:52:41 +0000 Subject: Add latest changes from gitlab-org/security/gitlab@13-3-stable-ee --- lib/api/api_guard.rb | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) (limited to 'lib/api') diff --git a/lib/api/api_guard.rb b/lib/api/api_guard.rb index 59978962b1d..46b69214877 100644 --- a/lib/api/api_guard.rb +++ b/lib/api/api_guard.rb @@ -69,7 +69,7 @@ module API deploy_token_from_request || find_user_from_bearer_token || find_user_from_job_token || - find_user_from_warden + user_from_warden end end @@ -103,6 +103,25 @@ module API def user_allowed_or_deploy_token?(user) Gitlab::UserAccess.new(user).allowed? || user.is_a?(DeployToken) end + + def user_from_warden + user = find_user_from_warden + + return unless user + return if two_factor_required_but_not_setup?(user) + + user + end + + def two_factor_required_but_not_setup?(user) + verifier = Gitlab::Auth::TwoFactorAuthVerifier.new(user) + + if verifier.two_factor_authentication_required? && verifier.current_user_needs_to_setup_two_factor? + verifier.two_factor_grace_period_expired? + else + false + end + end end class_methods do -- cgit v1.2.1