Skip to content

Commit 033aef5

Browse files
guillep2kzeripath
guillep2k
authored and
zeripath
committed
Various fixes in login sources (go-gitea#10428)
1 parent e938f1d commit 033aef5

File tree

15 files changed

+66
-21
lines changed

15 files changed

+66
-21
lines changed

‎models/error.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,21 @@ func (err ErrNamePatternNotAllowed) Error() string {
5656
return fmt.Sprintf("name pattern is not allowed [pattern: %s]", err.Pattern)
5757
}
5858

59+
// ErrNameCharsNotAllowed represents a "character not allowed in name" error.
60+
type ErrNameCharsNotAllowed struct {
61+
Name string
62+
}
63+
64+
// IsErrNameCharsNotAllowed checks if an error is an ErrNameCharsNotAllowed.
65+
func IsErrNameCharsNotAllowed(err error) bool {
66+
_, ok := err.(ErrNameCharsNotAllowed)
67+
return ok
68+
}
69+
70+
func (err ErrNameCharsNotAllowed) Error() string {
71+
return fmt.Sprintf("User name is invalid [%s]: must be valid alpha or numeric or dash(-_) or dot characters", err.Name)
72+
}
73+
5974
// ErrSSHDisabled represents an "SSH disabled" error.
6075
type ErrSSHDisabled struct {
6176
}

‎models/login_source.go

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ import (
1212
"fmt"
1313
"net/smtp"
1414
"net/textproto"
15-
"regexp"
1615
"strings"
1716

1817
"code.gitea.io/gitea/modules/auth/ldap"
@@ -455,10 +454,6 @@ func composeFullName(firstname, surname, username string) string {
455454
}
456455
}
457456

458-
var (
459-
alphaDashDotPattern = regexp.MustCompile(`[^\w-\.]`)
460-
)
461-
462457
// LoginViaLDAP queries if login/password is valid against the LDAP directory pool,
463458
// and create a local user if success when enabled.
464459
func LoginViaLDAP(user *User, login, password string, source *LoginSource) (*User, error) {
@@ -503,10 +498,6 @@ func LoginViaLDAP(user *User, login, password string, source *LoginSource) (*Use
503498
if len(sr.Username) == 0 {
504499
sr.Username = login
505500
}
506-
// Validate username make sure it satisfies requirement.
507-
if alphaDashDotPattern.MatchString(sr.Username) {
508-
return nil, fmt.Errorf("Invalid pattern for attribute 'username' [%s]: must be valid alpha or numeric or dash(-_) or dot characters", sr.Username)
509-
}
510501

511502
if len(sr.Mail) == 0 {
512503
sr.Mail = fmt.Sprintf("%s@localhost", sr.Username)
@@ -666,7 +657,8 @@ func LoginViaSMTP(user *User, login, password string, sourceID int64, cfg *SMTPC
666657
// LoginViaPAM queries if login/password is valid against the PAM,
667658
// and create a local user if success when enabled.
668659
func LoginViaPAM(user *User, login, password string, sourceID int64, cfg *PAMConfig) (*User, error) {
669-
if err := pam.Auth(cfg.ServiceName, login, password); err != nil {
660+
pamLogin, err := pam.Auth(cfg.ServiceName, login, password)
661+
if err != nil {
670662
if strings.Contains(err.Error(), "Authentication failure") {
671663
return nil, ErrUserNotExist{0, login, 0}
672664
}
@@ -677,14 +669,21 @@ func LoginViaPAM(user *User, login, password string, sourceID int64, cfg *PAMCon
677669
return user, nil
678670
}
679671

672+
// Allow PAM sources with `@` in their name, like from Active Directory
673+
username := pamLogin
674+
idx := strings.Index(pamLogin, "@")
675+
if idx > -1 {
676+
username = pamLogin[:idx]
677+
}
678+
680679
user = &User{
681-
LowerName: strings.ToLower(login),
682-
Name: login,
683-
Email: login,
680+
LowerName: strings.ToLower(username),
681+
Name: username,
682+
Email: pamLogin,
684683
Passwd: password,
685684
LoginType: LoginPAM,
686685
LoginSource: sourceID,
687-
LoginName: login,
686+
LoginName: login, // This is what the user typed in
688687
IsActive: true,
689688
}
690689
return user, CreateUser(user)

‎models/org_team_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -399,7 +399,7 @@ func TestIncludesAllRepositoriesTeams(t *testing.T) {
399399

400400
// Create org.
401401
org := &User{
402-
Name: "All repo",
402+
Name: "All_repo",
403403
IsActive: true,
404404
Type: UserTypeOrganization,
405405
Visibility: structs.VisibleTypePublic,

‎models/user.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"image/png"
1919
"os"
2020
"path/filepath"
21+
"regexp"
2122
"strconv"
2223
"strings"
2324
"time"
@@ -87,6 +88,9 @@ var (
8788

8889
// ErrUnsupportedLoginType login source is unknown error
8990
ErrUnsupportedLoginType = errors.New("Login source is unknown")
91+
92+
// Characters prohibited in a user name (anything except A-Za-z0-9_.-)
93+
alphaDashDotPattern = regexp.MustCompile(`[^\w-\.]`)
9094
)
9195

9296
// User represents the object of individual and member of organization.
@@ -870,6 +874,11 @@ func isUsableName(names, patterns []string, name string) error {
870874

871875
// IsUsableUsername returns an error when a username is reserved
872876
func IsUsableUsername(name string) error {
877+
// Validate username make sure it satisfies requirement.
878+
if alphaDashDotPattern.MatchString(name) {
879+
// Note: usually this error is normally caught up earlier in the UI
880+
return ErrNameCharsNotAllowed{Name: name}
881+
}
873882
return isUsableName(reservedUsernames, reservedUserPatterns, name)
874883
}
875884

‎modules/auth/pam/pam.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import (
1313
)
1414

1515
// Auth pam auth service
16-
func Auth(serviceName, userName, passwd string) error {
16+
func Auth(serviceName, userName, passwd string) (string, error) {
1717
t, err := pam.StartFunc(serviceName, userName, func(s pam.Style, msg string) (string, error) {
1818
switch s {
1919
case pam.PromptEchoOff:
@@ -25,12 +25,14 @@ func Auth(serviceName, userName, passwd string) error {
2525
})
2626

2727
if err != nil {
28-
return err
28+
return "", err
2929
}
3030

3131
if err = t.Authenticate(0); err != nil {
32-
return err
32+
return "", err
3333
}
3434

35-
return nil
35+
// PAM login names might suffer transformations in the PAM stack.
36+
// We should take whatever the PAM stack returns for it.
37+
return t.GetItem(pam.User)
3638
}

‎modules/auth/pam/pam_stub.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@ import (
1111
)
1212

1313
// Auth not supported lack of pam tag
14-
func Auth(serviceName, userName, passwd string) error {
15-
return errors.New("PAM not supported")
14+
func Auth(serviceName, userName, passwd string) (string, error) {
15+
return "", errors.New("PAM not supported")
1616
}

‎options/locale/locale_en-US.ini

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,7 @@ user_bio = Biography
374374
375375
form.name_reserved = The username '%s' is reserved.
376376
form.name_pattern_not_allowed = The pattern '%s' is not allowed in a username.
377+
form.name_chars_not_allowed = User name '%s' contains invalid characters.
377378
378379
[settings]
379380
profile = Profile

‎routers/admin/users.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,9 @@ func NewUserPost(ctx *context.Context, form auth.AdminCreateUserForm) {
121121
case models.IsErrNamePatternNotAllowed(err):
122122
ctx.Data["Err_UserName"] = true
123123
ctx.RenderWithErr(ctx.Tr("user.form.name_pattern_not_allowed", err.(models.ErrNamePatternNotAllowed).Pattern), tplUserNew, &form)
124+
case models.IsErrNameCharsNotAllowed(err):
125+
ctx.Data["Err_UserName"] = true
126+
ctx.RenderWithErr(ctx.Tr("user.form.name_chars_not_allowed", err.(models.ErrNameCharsNotAllowed).Name), tplUserNew, &form)
124127
default:
125128
ctx.ServerError("CreateUser", err)
126129
}

‎routers/api/v1/admin/org.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ func CreateOrg(ctx *context.APIContext, form api.CreateOrgOption) {
6666
if err := models.CreateOrganization(org, u); err != nil {
6767
if models.IsErrUserAlreadyExist(err) ||
6868
models.IsErrNameReserved(err) ||
69+
models.IsErrNameCharsNotAllowed(err) ||
6970
models.IsErrNamePatternNotAllowed(err) {
7071
ctx.Error(http.StatusUnprocessableEntity, "", err)
7172
} else {

‎routers/api/v1/admin/user.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ func CreateUser(ctx *context.APIContext, form api.CreateUserOption) {
9090
if models.IsErrUserAlreadyExist(err) ||
9191
models.IsErrEmailAlreadyUsed(err) ||
9292
models.IsErrNameReserved(err) ||
93+
models.IsErrNameCharsNotAllowed(err) ||
9394
models.IsErrNamePatternNotAllowed(err) {
9495
ctx.Error(http.StatusUnprocessableEntity, "", err)
9596
} else {

‎routers/api/v1/org/org.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ func Create(ctx *context.APIContext, form api.CreateOrgOption) {
112112
if err := models.CreateOrganization(org, ctx.User); err != nil {
113113
if models.IsErrUserAlreadyExist(err) ||
114114
models.IsErrNameReserved(err) ||
115+
models.IsErrNameCharsNotAllowed(err) ||
115116
models.IsErrNamePatternNotAllowed(err) {
116117
ctx.Error(http.StatusUnprocessableEntity, "", err)
117118
} else {

‎routers/api/v1/repo/repo.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,8 @@ func handleMigrateError(ctx *context.APIContext, repoOwner *models.User, remoteA
511511
ctx.Error(http.StatusUnprocessableEntity, "", fmt.Sprintf("You have already reached your limit of %d repositories.", repoOwner.MaxCreationLimit()))
512512
case models.IsErrNameReserved(err):
513513
ctx.Error(http.StatusUnprocessableEntity, "", fmt.Sprintf("The username '%s' is reserved.", err.(models.ErrNameReserved).Name))
514+
case models.IsErrNameCharsNotAllowed(err):
515+
ctx.Error(http.StatusUnprocessableEntity, "", fmt.Sprintf("The username '%s' contains invalid characters.", err.(models.ErrNameCharsNotAllowed).Name))
514516
case models.IsErrNamePatternNotAllowed(err):
515517
ctx.Error(http.StatusUnprocessableEntity, "", fmt.Sprintf("The pattern '%s' is not allowed in a username.", err.(models.ErrNamePatternNotAllowed).Pattern))
516518
default:

‎routers/user/auth.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -928,6 +928,7 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au
928928
LoginName: gothUser.(goth.User).UserID,
929929
}
930930

931+
//nolint: dupl
931932
if err := models.CreateUser(u); err != nil {
932933
switch {
933934
case models.IsErrUserAlreadyExist(err):
@@ -942,6 +943,9 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au
942943
case models.IsErrNamePatternNotAllowed(err):
943944
ctx.Data["Err_UserName"] = true
944945
ctx.RenderWithErr(ctx.Tr("user.form.name_pattern_not_allowed", err.(models.ErrNamePatternNotAllowed).Pattern), tplLinkAccount, &form)
946+
case models.IsErrNameCharsNotAllowed(err):
947+
ctx.Data["Err_UserName"] = true
948+
ctx.RenderWithErr(ctx.Tr("user.form.name_chars_not_allowed", err.(models.ErrNameCharsNotAllowed).Name), tplLinkAccount, &form)
945949
default:
946950
ctx.ServerError("CreateUser", err)
947951
}

‎routers/user/auth_openid.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,7 @@ func RegisterOpenIDPost(ctx *context.Context, cpt *captcha.Captcha, form auth.Si
400400
Passwd: password,
401401
IsActive: !setting.Service.RegisterEmailConfirm,
402402
}
403+
//nolint: dupl
403404
if err := models.CreateUser(u); err != nil {
404405
switch {
405406
case models.IsErrUserAlreadyExist(err):
@@ -414,6 +415,9 @@ func RegisterOpenIDPost(ctx *context.Context, cpt *captcha.Captcha, form auth.Si
414415
case models.IsErrNamePatternNotAllowed(err):
415416
ctx.Data["Err_UserName"] = true
416417
ctx.RenderWithErr(ctx.Tr("user.form.name_pattern_not_allowed", err.(models.ErrNamePatternNotAllowed).Pattern), tplSignUpOID, &form)
418+
case models.IsErrNameCharsNotAllowed(err):
419+
ctx.Data["Err_UserName"] = true
420+
ctx.RenderWithErr(ctx.Tr("user.form.name_chars_not_allowed", err.(models.ErrNameCharsNotAllowed).Name), tplSignUpOID, &form)
417421
default:
418422
ctx.ServerError("CreateUser", err)
419423
}

‎routers/user/setting/profile.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ func handleUsernameChange(ctx *context.Context, newName string) {
5858
case models.IsErrNamePatternNotAllowed(err):
5959
ctx.Flash.Error(ctx.Tr("user.form.name_pattern_not_allowed", newName))
6060
ctx.Redirect(setting.AppSubURL + "/user/settings")
61+
case models.IsErrNameCharsNotAllowed(err):
62+
ctx.Flash.Error(ctx.Tr("user.form.name_chars_not_allowed", newName))
63+
ctx.Redirect(setting.AppSubURL + "/user/settings")
6164
default:
6265
ctx.ServerError("ChangeUserName", err)
6366
}

0 commit comments

Comments
 (0)