diff options
| author | Norwin <noerw@users.noreply.github.com> | 2021-05-31 08:25:47 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-05-31 04:25:47 -0400 |
| commit | cb940c4312981893fdb54cbd0e07520546776b34 (patch) | |
| tree | 69ade3dd15712647ba04186008d3ffab203edf49 /modules/task/task.go | |
| parent | 256b1a35615487f27878422f877f25be3f066f54 (diff) | |
| download | gitea-cb940c4312981893fdb54cbd0e07520546776b34.tar.gz gitea-cb940c4312981893fdb54cbd0e07520546776b34.zip | |
Encrypt migration credentials at rest (#15895)
* encrypt migration credentials in task persistence
Not sure this is the best approach, we could encrypt the entire
`PayloadContent` instead. Also instead of clearing individual fields in
payload content, we could just delete the task once it has
(successfully) finished..?
* remove credentials of past migrations
* only run DB migration for completed tasks
* fix binding
* add omitempty
* never serialize unencrypted credentials
* fix import order
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Diffstat (limited to 'modules/task/task.go')
| -rw-r--r-- | modules/task/task.go | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/modules/task/task.go b/modules/task/task.go index 0443517c01..0685aa23d7 100644 --- a/modules/task/task.go +++ b/modules/task/task.go @@ -13,8 +13,11 @@ import ( "code.gitea.io/gitea/modules/migrations/base" "code.gitea.io/gitea/modules/queue" repo_module "code.gitea.io/gitea/modules/repository" + "code.gitea.io/gitea/modules/secret" + "code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/structs" "code.gitea.io/gitea/modules/timeutil" + "code.gitea.io/gitea/modules/util" jsoniter "github.com/json-iterator/go" ) @@ -65,6 +68,24 @@ func MigrateRepository(doer, u *models.User, opts base.MigrateOptions) error { // CreateMigrateTask creates a migrate task func CreateMigrateTask(doer, u *models.User, opts base.MigrateOptions) (*models.Task, error) { + // encrypt credentials for persistence + var err error + opts.CloneAddrEncrypted, err = secret.EncryptSecret(setting.SecretKey, opts.CloneAddr) + if err != nil { + return nil, err + } + opts.CloneAddr = util.SanitizeURLCredentials(opts.CloneAddr, true) + opts.AuthPasswordEncrypted, err = secret.EncryptSecret(setting.SecretKey, opts.AuthPassword) + if err != nil { + return nil, err + } + opts.AuthPassword = "" + opts.AuthTokenEncrypted, err = secret.EncryptSecret(setting.SecretKey, opts.AuthToken) + if err != nil { + return nil, err + } + opts.AuthToken = "" + json := jsoniter.ConfigCompatibleWithStandardLibrary bs, err := json.Marshal(&opts) if err != nil { |