Commit d2716cde authored by Gabriel Mazetto's avatar Gabriel Mazetto

Geo: Redirect when using disallowed requests on readonly

parent 8e8731aa
module Gitlab
module Middleware
class ReadonlyGeo
READONLY_METHODS = %w(PATCH PUT DELETE)
DISALLOWED_METHODS = %w(PATCH PUT DELETE)
def initialize(app)
@app = app
end
def call(env)
if READONLY_METHODS.include?(env['REQUEST_METHOD']) && Gitlab::Geo.readonly?
@env = env
if disallowed_request? && Gitlab::Geo.readonly?
Rails.logger.debug('Gitlab Geo: preventing possible non readonly operation')
rflash = rack_flash(env)
rflash.alert= 'You are using Gitlab Geo'
env['rack.session']['flash'] = rflash.to_session_value
rack_flash.alert = 'You cannot do writing operations on a readonly Gitlab Geo instance'
rack_session['flash'] = rack_flash.to_session_value
#TODO: should redirect to last visited page or root url
return [301, { 'Location' => last_visited_url}, [] ]
end
@app.call(env)
......@@ -23,8 +24,25 @@ module Gitlab
private
def rack_flash(env)
ActionDispatch::Flash::FlashHash.from_session_value(env['rack.session'])
def disallowed_request?
DISALLOWED_METHODS.include?(@env['REQUEST_METHOD'])
end
def rack_flash
@rack_flash ||= ActionDispatch::Flash::FlashHash.from_session_value(rack_session)
end
def rack_session
@env['rack.session']
end
def request
@request ||= Rack::Request.new(@env)
end
def last_visited_url
Rails.logger.debug("SESSION: #{rack_session.inspect}")
@env['HTTP_REFERER'] || rack_session['user_return_to'] || Rails.application.routes.url_helpers.root_url
end
end
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment