8000 token: disallow multiple tokens with same name by frodeaa · Pull Request #5820 · gogs/gogs · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

token: disallow multiple tokens with same name #5820

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 15, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions conf/locale/locale_en-US.ini
Original file line number Diff line number Diff line change
Expand Up @@ -374,6 +374,7 @@ delete_token = Delete
access_token_deletion = Personal Access Token Deletion
access_token_deletion_desc = Delete this personal access token will remove all related accesses of application. Do you want to continue?
delete_token_success = Personal access token has been removed successfully! Don't forget to update your application as well.
token_name_exists = Token with same name already exists.

orgs.none = You are not a member of any organizations.
orgs.leave_title = Leave organization
Expand Down
16 changes: 16 additions & 0 deletions models/errors/token.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
package errors

import "fmt"

type AccessTokenNameAlreadyExist struct {
Name string
}

func IsAccessTokenNameAlreadyExist(err error) bool {
_, ok := err.(AccessTokenNameAlreadyExist)
return ok
}

func (err AccessTokenNameAlreadyExist) Error() string {
return fmt.Sprintf("access token already exist [name: %s]", err.Name)
}
18 changes: 15 additions & 3 deletions models/token.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,13 @@
package models

import (
"fmt"
"time"

"github.com/go-xorm/xorm"
gouuid "github.com/satori/go.uuid"

"github.com/gogs/gogs/models/errors"
"github.com/gogs/gogs/pkg/tool"
gouuid "github.com/satori/go.uuid"
)

// AccessToken represents a personal access token.
Expand Down Expand Up @@ -47,10 +48,21 @@ func (t *AccessToken) AfterSet(colName string, _ xorm.Cell) {
}
}

func isAccessTokenNameExist(uid int64, name string) (bool, error) {
return x.Where("uid=?", uid).And("name=?", name).Get(&AccessToken{})
}

// NewAccessToken creates new access token.
func NewAccessToken(t *AccessToken) error {
t.Sha1 = tool.SHA1(gouuid.NewV4().String())
_, err := x.Insert(t)
has, err := isAccessTokenNameExist(t.UID, t.Name)
if err != nil {
return fmt.Errorf("IsAccessTokenNameExists: %v", err)
} else if has {
return errors.AccessTokenNameAlreadyExist{t.Name}
}

_, err = x.Insert(t)
return err
}

Expand Down
7 changes: 6 additions & 1 deletion routes/api/v1/user/app.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
api "github.com/gogs/go-gogs-client"

"github.com/gogs/gogs/models"
"github.com/gogs/gogs/models/errors"
"github.com/gogs/gogs/pkg/context"
)

Expand All @@ -33,7 +34,11 @@ func CreateAccessToken(c *context.APIContext, form api.CreateAccessTokenOption)
Name: form.Name,
}
if err := models.NewAccessToken(t); err != nil {
c.ServerError("NewAccessToken", err)
if errors.IsAccessTokenNameAlreadyExist(err) {
c.Error(http.StatusUnprocessableEntity, "", err)
} else {
c.ServerError("NewAccessToken", err)
}
return
}
c.JSON(http.StatusCreated, &api.AccessToken{t.Name, t.Sha1})
Expand Down
7 changes: 6 additions & 1 deletion routes/user/setting.go
Original file line number Diff line number Diff line change
Expand Up @@ -607,7 +607,12 @@ func SettingsApplicationsPost(c *context.Context, f form.NewAccessToken) {
Name: f.Name,
}
if err := models.NewAccessToken(t); err != nil {
c.ServerError("NewAccessToken", err)
if errors.IsAccessTokenNameAlreadyExist(err) {
c.Flash.Error(c.Tr("settings.token_name_exists"))
c.SubURLRedirect("/user/settings/applications")
} else {
c.ServerError("NewAccessToken", err)
}
return
}

Expand Down
0