gitlab_omniauth-ldap 2.0.2 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 490e5818be98881b26e804e7d75021b1a22aaca2
-  data.tar.gz: 185305045176824f1f43de77cf762fc0094a3db9
+  metadata.gz: ac7ceaa4ec67ee276ca4d7f8c20bc1326f31fc3f
+  data.tar.gz: 43ac5e5252e03e8780695d7a05c15aa0c2f4df0a
 SHA512:
-  metadata.gz: e74ed52e82763ff87707d60339b24107737dc03c62e25fca0897e18b25bf4cfa3a0af8eb27e7899ebb9141c90918eac200eb699394ff0165fef059a68d63760d
-  data.tar.gz: 20aff7c1a787d21313981cdc6849245306d17778602f368f8f11a0c5a3c69c08f16aaa4b57982d9d1e101512f3fc8890255f1d3b8cf1c19a40204eeb9f9bd378
+  metadata.gz: b772560d1bdf110ce019fddc837e0332cd9449934f20deed0bbf034c91fe683f19f1a492f258ebd86f920427c4813227669a18a05b955cd2f4c3bd4538c7665e
+  data.tar.gz: bd91d1d785dd0931e3c2602622324eec46017c9b91d30b695d6edbacb1cb920b2a8ff80855d97363b59873dee1bfe50ee152a1f25da9a86e2ebd9b17fa29c0d6

data/CHANGELOG

@@ -0,0 +1,2 @@
+## 2.0.3
+  - Protects against wrong request method call to callback

data/lib/omniauth-ldap/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module LDAP
-    VERSION = "2.0.2"
+    VERSION = "2.0.3"
   end
 end

data/lib/omniauth/strategies/ldap.rb

@@ -40,6 +40,7 @@ module OmniAuth
       def callback_phase
         @adaptor = OmniAuth::LDAP::Adaptor.new @options
 
+        return fail!(:invalid_request_method) unless valid_request_method?
         return fail!(:missing_credentials) if missing_credentials?
         begin
           @ldap_user_info = @adaptor.bind_as(:filter => filter(@adaptor), :size => 1, :password => request['password'])
@@ -96,6 +97,10 @@ module OmniAuth
 
       protected
 
+      def valid_request_method?
+        request.env['REQUEST_METHOD'] == 'POST'
+      end
+
       def missing_credentials?
         request['username'].nil? or request['username'].empty? or request['password'].nil? or request['password'].empty?
       end # missing_credentials?

data/spec/omniauth/strategies/ldap_spec.rb

@@ -80,6 +80,15 @@ describe "OmniAuth::Strategies::LDAP" do
         last_response.headers['Location'].should =~ %r{ldap_error}
       end
 
+      context 'wrong request method' do
+        it 'redirects to error page' do
+          get('/auth/ldap/callback', { username: 'ping', password: 'password' })
+
+          expect(last_response).to be_redirect
+          expect(last_response.headers['Location']).to match('invalid_request_method')
+        end
+      end
+
       context "when username is not preset" do
         it 'should redirect to error page' do
           post('/auth/ldap/callback', {})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab_omniauth-ldap
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.0.3
 platform: ruby
 authors:
 - Ping Yu
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-13 00:00:00.000000000 Z
+date: 2017-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth
@@ -139,6 +139,7 @@ files:
 - ".gitlab-ci.yml"
 - ".rspec"
 - ".travis.yml"
+- CHANGELOG
 - Gemfile
 - Guardfile
 - README.md
@@ -171,7 +172,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.8
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: A LDAP strategy for OmniAuth.