engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

token-access: allow token in headers not only in GET/URL

Browse source
This commit is contained in:
Milka Kuzminski 2020-12-21 12:34:05 +01:00
parent 90f844d8c1
commit 274ad239e5
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
rhodecode/lib/base.py
View file

@ -469,7 +469,14 @@ def get_auth_user(request):
ip_addr = get_ip_addr(environ) ip_addr = get_ip_addr(environ)
# make sure that we update permissions each time we call controller # make sure that we update permissions each time we call controller
_auth_token = (request.GET.get('auth_token', '') or request.GET.get('api_key', '')) _auth_token = (
# ?auth_token=XXX
request.GET.get('auth_token', '')
# ?api_key=XXX !LEGACY
or request.GET.get('api_key', '')
# or headers....
or request.headers.get('X-Rc-Auth-Token', '')
)
if not _auth_token and request.matchdict: if not _auth_token and request.matchdict:
url_auth_token = request.matchdict.get('_auth_token') url_auth_token = request.matchdict.get('_auth_token')
_auth_token = url_auth_token _auth_token = url_auth_token

1
rhodecode/tweens.py
View file

@ -119,3 +119,4 @@ def includeme(config):
# This needs to be the LAST item # This needs to be the LAST item
config.add_tween('rhodecode.lib.middleware.request_wrapper.RequestWrapperTween') config.add_tween('rhodecode.lib.middleware.request_wrapper.RequestWrapperTween')
log.debug('configured all tweens')