delta/gitlab/gitlab-ce.git/app/controllers/omniauth_callbacks_controller.rb, branch patch-53

Externalize strings in flash messages

2019-04-08T14:17:45+00:00

- Externalize strings in controllers
- Update PO file

Move out link\unlink ability checks to a policy

2019-03-19T12:38:16+00:00

We can extend the policy in EE for additional behavior

Backport build_auth_user for GroupSAML callback

2019-02-06T17:28:35+00:00

Avoid CSRF check on SAML failure endpoint

2019-02-04T10:10:51+00:00

SAML and OAuth failures should cause a message to be presented, as well
as logging that an attempt was made. These were incorrectly prevented by
the CSRF check on POST endpoints such as SAML.

In addition we were using a NullSession forgery protection, which made
testing more difficult and could have allowed account linking to take
place if a CSRF was ever needed but not present.

Addressing peer review feedback.

2019-01-10T06:00:39+00:00

Replacing inline JS with ES 2015 functions included in pages/sessions/new. Also applying suggested server-side syntax improvements to OmniAuthCallbacksController.

Preserve URL fragment across sign-in and sign-up redirects

2019-01-10T06:00:38+00:00

If window.location contains a URL fragment, append the fragment to all sign-in forms, the sign-up form, and all button based providers.

Enable frozen string in app/controllers/**/*.rb

2018-09-19T04:22:45+00:00

Enables frozen string for the following:

* app/controllers/*.rb
* app/controllers/admin/**/*.rb
* app/controllers/boards/**/*.rb
* app/controllers/ci/**/*.rb
* app/controllers/concerns/**/*.rb

Partially addresses #47424.

Honor saml assurance level to allow 2FA bypassing

2018-06-25T15:32:03+00:00

[Rails5] Force the `protect_from_forgery` callback run first

2018-06-21T10:44:31+00:00

Since Rails 5.0 the `protect_from_forgery` callback doesn't run first by
default anymore. [1]

Instead it gets inserted into callbacks chain where callbacks get
called in order.

This commit forces the callback to run first.

[1]: https://github.com/rails/rails/commit/39794037817703575c35a75f1961b01b83791191

Backport helpers from GroupSAML failure messages

2018-05-21T15:43:12+00:00