Commit d2716cde authored by Gabriel Mazetto's avatar Gabriel Mazetto

Geo: Redirect when using disallowed requests on readonly

parent 8e8731aa
module Gitlab module Gitlab
module Middleware module Middleware
class ReadonlyGeo class ReadonlyGeo
READONLY_METHODS = %w(PATCH PUT DELETE) DISALLOWED_METHODS = %w(PATCH PUT DELETE)
def initialize(app) def initialize(app)
@app = app @app = app
end end
def call(env) def call(env)
if READONLY_METHODS.include?(env['REQUEST_METHOD']) && Gitlab::Geo.readonly? @env = env
if disallowed_request? && Gitlab::Geo.readonly?
Rails.logger.debug('Gitlab Geo: preventing possible non readonly operation') Rails.logger.debug('Gitlab Geo: preventing possible non readonly operation')
rflash = rack_flash(env) rack_flash.alert = 'You cannot do writing operations on a readonly Gitlab Geo instance'
rflash.alert= 'You are using Gitlab Geo' rack_session['flash'] = rack_flash.to_session_value
env['rack.session']['flash'] = rflash.to_session_value
#TODO: should redirect to last visited page or root url return [301, { 'Location' => last_visited_url}, [] ]
end end
@app.call(env) @app.call(env)
...@@ -23,8 +24,25 @@ module Gitlab ...@@ -23,8 +24,25 @@ module Gitlab
private private
def rack_flash(env) def disallowed_request?
ActionDispatch::Flash::FlashHash.from_session_value(env['rack.session']) DISALLOWED_METHODS.include?(@env['REQUEST_METHOD'])
end
def rack_flash
@rack_flash ||= ActionDispatch::Flash::FlashHash.from_session_value(rack_session)
end
def rack_session
@env['rack.session']
end
def request
@request ||= Rack::Request.new(@env)
end
def last_visited_url
Rails.logger.debug("SESSION: #{rack_session.inspect}")
@env['HTTP_REFERER'] || rack_session['user_return_to'] || Rails.application.routes.url_helpers.root_url
end end
end end
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment