From 6e7db8e23e169bcbf0847ece27b9e44e00ae572b Mon Sep 17 00:00:00 2001
From: Gabriel Mazetto <gabriel@gitlab.com>
Date: Wed, 30 Dec 2015 16:52:02 -0200
Subject: Prevent ldap_blocked users from being blocked/unblocked by the API

---
 lib/api/users.rb | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to 'lib')

diff --git a/lib/api/users.rb b/lib/api/users.rb
index 0d7813428e2..01fd90139b0 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -284,10 +284,12 @@ module API
         authenticated_as_admin!
         user = User.find_by(id: params[:id])
 
-        if user
+        if !user
+          not_found!('User')
+        elsif !user.ldap_blocked?
           user.block
         else
-          not_found!('User')
+          forbidden!('LDAP blocked users cannot be modified by the API')
         end
       end
 
@@ -299,10 +301,12 @@ module API
         authenticated_as_admin!
         user = User.find_by(id: params[:id])
 
-        if user
+        if !user
+          not_found!('User')
+        elsif !user.ldap_blocked?
           user.activate
         else
-          not_found!('User')
+          forbidden!('LDAP blocked users cannot be unblocked by the API')
         end
       end
     end
-- 
cgit v1.2.1


From d6dc088affeee4568e771e1d7894e0bcdb955af8 Mon Sep 17 00:00:00 2001
From: Gabriel Mazetto <gabriel@gitlab.com>
Date: Wed, 30 Dec 2015 20:56:26 -0200
Subject: LDAP synchronization block/unblock new states

---
 lib/gitlab/ldap/access.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/ldap/access.rb b/lib/gitlab/ldap/access.rb
index c438a3d167b..76cb48d7aa6 100644
--- a/lib/gitlab/ldap/access.rb
+++ b/lib/gitlab/ldap/access.rb
@@ -37,15 +37,15 @@ module Gitlab
 
           # Block user in GitLab if he/she was blocked in AD
           if Gitlab::LDAP::Person.disabled_via_active_directory?(user.ldap_identity.extern_uid, adapter)
-            user.block
+            user.ldap_block
             false
           else
-            user.activate if user.blocked? && !ldap_config.block_auto_created_users
+            user.activate if (user.blocked? && !ldap_config.block_auto_created_users) || user.ldap_blocked?
             true
           end
         else
           # Block the user if they no longer exist in LDAP/AD
-          user.block 
+          user.ldap_block
           false
         end
       rescue
-- 
cgit v1.2.1


From 47e4613f4adc2d6ef4b066a87ec772ef8044bdd5 Mon Sep 17 00:00:00 2001
From: Gabriel Mazetto <gabriel@gitlab.com>
Date: Thu, 7 Jan 2016 14:01:01 -0200
Subject: Code style fixes and some code simplified

---
 lib/gitlab/ldap/access.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/gitlab/ldap/access.rb b/lib/gitlab/ldap/access.rb
index 76cb48d7aa6..ebd9260ad5d 100644
--- a/lib/gitlab/ldap/access.rb
+++ b/lib/gitlab/ldap/access.rb
@@ -40,7 +40,9 @@ module Gitlab
             user.ldap_block
             false
           else
-            user.activate if (user.blocked? && !ldap_config.block_auto_created_users) || user.ldap_blocked?
+            if (user.blocked? && !ldap_config.block_auto_created_users) || user.ldap_blocked?
+              user.activate
+            end
             true
           end
         else
-- 
cgit v1.2.1


From ac6a10f3e88c5d2081b8638df63016089517a844 Mon Sep 17 00:00:00 2001
From: Gabriel Mazetto <gabriel@gitlab.com>
Date: Tue, 12 Jan 2016 12:29:10 -0200
Subject: Codestyle changes

---
 lib/api/users.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/api/users.rb b/lib/api/users.rb
index 01fd90139b0..fd2128bd179 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -303,10 +303,10 @@ module API
 
         if !user
           not_found!('User')
-        elsif !user.ldap_blocked?
-          user.activate
-        else
+        elsif user.ldap_blocked?
           forbidden!('LDAP blocked users cannot be unblocked by the API')
+        else
+          user.activate
         end
       end
     end
-- 
cgit v1.2.1


From dd6fc01ff8a073880b67a323a547edeb5d63f167 Mon Sep 17 00:00:00 2001
From: Gabriel Mazetto <gabriel@gitlab.com>
Date: Thu, 14 Jan 2016 03:31:27 -0200
Subject: fixed LDAP activation on login to use new ldap_blocked state

---
 lib/gitlab/ldap/access.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/gitlab/ldap/access.rb b/lib/gitlab/ldap/access.rb
index ebd9260ad5d..a659d179b5f 100644
--- a/lib/gitlab/ldap/access.rb
+++ b/lib/gitlab/ldap/access.rb
@@ -40,9 +40,7 @@ module Gitlab
             user.ldap_block
             false
           else
-            if (user.blocked? && !ldap_config.block_auto_created_users) || user.ldap_blocked?
-              user.activate
-            end
+            user.activate if user.ldap_blocked?
             true
           end
         else
-- 
cgit v1.2.1