Commit 7aa739dd authored by Stan Hu's avatar Stan Hu Committed by Rémy Coutable

Support download access by PRIVATE-TOKEN header

Currently there is no way to download a raw file without embedding
the token in the URL, which exposes the token in the URL. There
should be an way of sending this information via the header as the
API does.

Closes https://github.com/gitlabhq/gitlabhq/issues/8137
parent bb51e9c6
...@@ -6,6 +6,7 @@ v 8.5.0 (unreleased) ...@@ -6,6 +6,7 @@ v 8.5.0 (unreleased)
- Add "visibility" flag to GET /projects api endpoint - Add "visibility" flag to GET /projects api endpoint
- Ignore binary files in code search to prevent Error 500 (Stan Hu) - Ignore binary files in code search to prevent Error 500 (Stan Hu)
- Render sanitized SVG images (Stan Hu) - Render sanitized SVG images (Stan Hu)
- Support download access by PRIVATE-TOKEN header (Stan Hu)
- Upgrade gitlab_git to 7.2.23 to fix commit message mentions in first branch push - Upgrade gitlab_git to 7.2.23 to fix commit message mentions in first branch push
- New UI for pagination - New UI for pagination
- Don't prevent sign out when 2FA enforcement is enabled and user hasn't yet - Don't prevent sign out when 2FA enforcement is enabled and user hasn't yet
......
...@@ -60,6 +60,8 @@ class ApplicationController < ActionController::Base ...@@ -60,6 +60,8 @@ class ApplicationController < ActionController::Base
params[:authenticity_token].presence params[:authenticity_token].presence
elsif params[:private_token].presence elsif params[:private_token].presence
params[:private_token].presence params[:private_token].presence
elsif request.headers['PRIVATE-TOKEN'].present?
request.headers['PRIVATE-TOKEN']
end end
user = user_token && User.find_by_authentication_token(user_token.to_s) user = user_token && User.find_by_authentication_token(user_token.to_s)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment