haskal
/
vagrant
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #9145 from hashicorp/login-middleware-auth-hosts 

Add app.vagrantup.com to allowed auth hosts
This commit is contained in:
Justin Campbell 2017-11-15 14:17:55 -05:00 committed by GitHub
parent 32ac51b27c 40d8dc4582
commit f1863a8243
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
plugins/commands/login/middleware/add_authentication.rb
View File

@ -6,8 +6,11 @@ require_relative "../client"
module VagrantPlugins
module LoginCommand
class AddAuthentication
VCLOUD = "vagrantcloud.com".freeze
ATLAS = "atlas.hashicorp.com".freeze
ALLOWED_AUTHENTICATION_HOSTS = %w[
app.vagrantup.com
atlas.hashicorp.com
vagrantcloud.com
].freeze
def initialize(app, env)
@app = app
@ -25,12 +28,8 @@ module VagrantPlugins
replace = u.host == server_uri.host
if !replace
# We need this in here for the transition we made from
# Vagrant Cloud to Atlas. This preserves access tokens
# appending to both without leaking access tokens to
# unsavory URLs.
if (u.host == VCLOUD && server_uri.host == ATLAS) ||
(u.host == ATLAS && server_uri.host == VCLOUD)
if ALLOWED_AUTHENTICATION_HOSTS.include?(u.host) &&
ALLOWED_AUTHENTICATION_HOSTS.include?(server_uri.host)
replace = true
end
end

4
test/unit/plugins/commands/login/middleware/add_authentication_test.rb
View File

@ -71,13 +71,15 @@ describe VagrantPlugins::LoginCommand::AddAuthentication do
original = [
"http://google.com/box.box",
"http://app.vagrantup.com/foo.box",
"http://vagrantcloud.com/foo.box",
"http://vagrantcloud.com/bar.box?arg=true",
]
expected = original.dup
expected[1] = "#{original[1]}?access_token=#{token}"
expected[2] = "#{original[2]}&access_token=#{token}"
expected[2] = "#{original[2]}?access_token=#{token}"
expected[3] = "#{original[3]}&access_token=#{token}"
env[:box_urls] = original.dup
subject.call(env)