From 553dc2de8262bb6fad4e715d71ab92640cb25a85 Mon Sep 17 00:00:00 2001 From: SolidNerd Date: Fri, 23 Sep 2016 00:31:14 +0200 Subject: [PATCH] update gitlab rackt_attack.rb --- assets/runtime/config/gitlabhq/rack_attack.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/assets/runtime/config/gitlabhq/rack_attack.rb b/assets/runtime/config/gitlabhq/rack_attack.rb index b1bbcca1..f650bd92 100644 --- a/assets/runtime/config/gitlabhq/rack_attack.rb +++ b/assets/runtime/config/gitlabhq/rack_attack.rb @@ -10,15 +10,16 @@ paths_to_be_protected = [ "#{Rails.application.config.relative_url_root}/api/#{API::API.version}/session", "#{Rails.application.config.relative_url_root}/users", "#{Rails.application.config.relative_url_root}/users/confirmation", - "#{Rails.application.config.relative_url_root}/unsubscribes/" - + "#{Rails.application.config.relative_url_root}/unsubscribes/", + "#{Rails.application.config.relative_url_root}/import/github/personal_access_token" ] # Create one big regular expression that matches strings starting with any of # the paths_to_be_protected. paths_regex = Regexp.union(paths_to_be_protected.map { |path| /\A#{Regexp.escape(path)}/ }) +rack_attack_enabled = Gitlab.config.rack_attack.git_basic_auth['enabled'] -unless Rails.env.test? +unless Rails.env.test? || !rack_attack_enabled Rack::Attack.throttle('protected paths', limit: 10, period: 60.seconds) do |req| if req.post? && req.path =~ paths_regex req.ip