Skip to content

Commit ad1164f

Browse files
zeripathlunny
andauthored
Disable SSH key deletion of externally managed Keys (#13985)
* Disable SSH key addition and deletion when externally managed When a user has a login source which has SSH key management key addition and deletion using the UI should be disabled. Fix #13983 Signed-off-by: Andrew Thornton <[email protected]> * Make only externally managed keys disabled Signed-off-by: Andrew Thornton <[email protected]> Co-authored-by: Lunny Xiao <[email protected]>
1 parent a19447a commit ad1164f

File tree

5 files changed

+125
-21
lines changed

5 files changed

+125
-21
lines changed

models/ssh_key.go

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -665,6 +665,82 @@ func deletePublicKeys(e Engine, keyIDs ...int64) error {
665665
return err
666666
}
667667

668+
// PublicKeysAreExternallyManaged returns whether the provided KeyID represents an externally managed Key
669+
func PublicKeysAreExternallyManaged(keys []*PublicKey) ([]bool, error) {
670+
sources := make([]*LoginSource, 0, 5)
671+
externals := make([]bool, len(keys))
672+
keyloop:
673+
for i, key := range keys {
674+
if key.LoginSourceID == 0 {
675+
externals[i] = false
676+
continue keyloop
677+
}
678+
679+
var source *LoginSource
680+
681+
sourceloop:
682+
for _, s := range sources {
683+
if s.ID == key.LoginSourceID {
684+
source = s
685+
break sourceloop
686+
}
687+
}
688+
689+
if source == nil {
690+
var err error
691+
source, err = GetLoginSourceByID(key.LoginSourceID)
692+
if err != nil {
693+
if IsErrLoginSourceNotExist(err) {
694+
externals[i] = false
695+
sources[i] = &LoginSource{
696+
ID: key.LoginSourceID,
697+
}
698+
continue keyloop
699+
}
700+
return nil, err
701+
}
702+
}
703+
704+
ldapSource := source.LDAP()
705+
if ldapSource != nil &&
706+
source.IsSyncEnabled &&
707+
(source.Type == LoginLDAP || source.Type == LoginDLDAP) &&
708+
len(strings.TrimSpace(ldapSource.AttributeSSHPublicKey)) > 0 {
709+
// Disable setting SSH keys for this user
710+
externals[i] = true
711+
}
712+
}
713+
714+
return externals, nil
715+
}
716+
717+
// PublicKeyIsExternallyManaged returns whether the provided KeyID represents an externally managed Key
718+
func PublicKeyIsExternallyManaged(id int64) (bool, error) {
719+
key, err := GetPublicKeyByID(id)
720+
if err != nil {
721+
return false, err
722+
}
723+
if key.LoginSourceID == 0 {
724+
return false, nil
725+
}
726+
source, err := GetLoginSourceByID(key.LoginSourceID)
727+
if err != nil {
728+
if IsErrLoginSourceNotExist(err) {
729+
return false, nil
730+
}
731+
return false, err
732+
}
733+
ldapSource := source.LDAP()
734+
if ldapSource != nil &&
735+
source.IsSyncEnabled &&
736+
(source.Type == LoginLDAP || source.Type == LoginDLDAP) &&
737+
len(strings.TrimSpace(ldapSource.AttributeSSHPublicKey)) > 0 {
738+
// Disable setting SSH keys for this user
739+
return true, nil
740+
}
741+
return false, nil
742+
}
743+
668744
// DeletePublicKey deletes SSH key information both in database and authorized_keys file.
669745
func DeletePublicKey(doer *User, id int64) (err error) {
670746
key, err := GetPublicKeyByID(id)

options/locale/locale_en-US.ini

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -556,6 +556,7 @@ principal_state_desc = This principal has been used in the last 7 days
556556
show_openid = Show on profile
557557
hide_openid = Hide from profile
558558
ssh_disabled = SSH Disabled
559+
ssh_externally_managed = This SSH key is externally managed for this user
559560
manage_social = Manage Associated Social Accounts
560561
social_desc = These social accounts are linked to your Gitea account. Make sure you recognize all of them as they can be used to sign in to your Gitea account.
561562
unbind = Unlink

routers/api/v1/user/key.go

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,16 @@ func DeletePublicKey(ctx *context.APIContext) {
267267
// "404":
268268
// "$ref": "#/responses/notFound"
269269

270-
if err := models.DeletePublicKey(ctx.User, ctx.ParamsInt64(":id")); err != nil {
270+
id := ctx.ParamsInt64(":id")
271+
externallyManaged, err := models.PublicKeyIsExternallyManaged(id)
272+
if err != nil {
273+
ctx.Error(http.StatusInternalServerError, "PublicKeyIsExternallyManaged", err)
274+
}
275+
if externallyManaged {
276+
ctx.Error(http.StatusForbidden, "", "SSH Key is externally managed for this user")
277+
}
278+
279+
if err := models.DeletePublicKey(ctx.User, id); err != nil {
271280
if models.IsErrKeyNotExist(err) {
272281
ctx.NotFound()
273282
} else if models.IsErrKeyAccessDenied(err) {

routers/user/setting/keys.go

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,18 @@ func DeleteKey(ctx *context.Context) {
160160
ctx.Flash.Success(ctx.Tr("settings.gpg_key_deletion_success"))
161161
}
162162
case "ssh":
163-
if err := models.DeletePublicKey(ctx.User, ctx.QueryInt64("id")); err != nil {
163+
keyID := ctx.QueryInt64("id")
164+
external, err := models.PublicKeyIsExternallyManaged(keyID)
165+
if err != nil {
166+
ctx.ServerError("sshKeysExternalManaged", err)
167+
return
168+
}
169+
if external {
170+
ctx.Flash.Error(ctx.Tr("setting.ssh_externally_managed"))
171+
ctx.Redirect(setting.AppSubURL + "/user/settings/keys")
172+
return
173+
}
174+
if err := models.DeletePublicKey(ctx.User, keyID); err != nil {
164175
ctx.Flash.Error("DeletePublicKey: " + err.Error())
165176
} else {
166177
ctx.Flash.Success(ctx.Tr("settings.ssh_key_deletion_success"))
@@ -188,6 +199,13 @@ func loadKeysData(ctx *context.Context) {
188199
}
189200
ctx.Data["Keys"] = keys
190201

202+
externalKeys, err := models.PublicKeysAreExternallyManaged(keys)
203+
if err != nil {
204+
ctx.ServerError("ListPublicKeys", err)
205+
return
206+
}
207+
ctx.Data["ExternalKeys"] = externalKeys
208+
191209
gpgkeys, err := models.ListGPGKeys(ctx.User.ID, models.ListOptions{})
192210
if err != nil {
193211
ctx.ServerError("ListGPGKeys", err)

templates/user/settings/keys_ssh.tmpl

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<h4 class="ui top attached header">
22
{{.i18n.Tr "settings.manage_ssh_keys"}}
33
<div class="ui right">
4-
{{if not .DisableSSH}}
4+
{{if not .DisableSSH }}
55
<div class="ui blue tiny show-panel button" data-panel="#add-ssh-key-panel">{{.i18n.Tr "settings.add_key"}}</div>
66
{{else}}
77
<div class="ui blue tiny button disabled">{{.i18n.Tr "settings.ssh_disabled"}}</div>
@@ -13,25 +13,25 @@
1313
<div class="item">
1414
{{.i18n.Tr "settings.ssh_desc"}}
1515
</div>
16-
{{range .Keys}}
16+
{{range $index, $key := .Keys}}
1717
<div class="item">
18-
<div class="right floated content">
19-
<button class="ui red tiny button delete-button" id="delete-ssh" data-url="{{$.Link}}/delete?type=ssh" data-id="{{.ID}}">
20-
{{$.i18n.Tr "settings.delete_key"}}
21-
</button>
22-
</div>
23-
<div class="left floated content">
24-
<span class="{{if .HasRecentActivity}}green{{end}}" {{if .HasRecentActivity}}data-content="{{$.i18n.Tr "settings.key_state_desc"}}" data-variation="inverted tiny"{{end}}>{{svg "octicon-key" 32}}</span>
25-
</div>
26-
<div class="content">
27-
<strong>{{.Name}}</strong>
28-
<div class="print meta">
29-
{{.Fingerprint}}
30-
</div>
31-
<div class="activity meta">
32-
<i>{{$.i18n.Tr "settings.add_on"}} <span>{{.CreatedUnix.FormatShort}}</span> — {{svg "octicon-info"}} {{if .HasUsed}}{{$.i18n.Tr "settings.last_used"}} <span {{if .HasRecentActivity}}class="green"{{end}}>{{.UpdatedUnix.FormatShort}}</span>{{else}}{{$.i18n.Tr "settings.no_activity"}}{{end}}</i>
33-
</div>
34-
</div>
18+
<div class="right floated content">
19+
<button class="ui red tiny button delete-button{{if index $.ExternalKeys $index}} disabled{{end}}" id="delete-ssh" data-url="{{$.Link}}/delete?type=ssh" data-id="{{.ID}}"{{if index $.ExternalKeys $index}} title="{{$.i18n.Tr "settings.ssh_externally_managed"}}"{{end}}>
20+
{{$.i18n.Tr "settings.delete_key"}}
21+
</button>
22+
</div>
23+
<div class="left floated content">
24+
<span class="{{if .HasRecentActivity}}green{{end}}" {{if .HasRecentActivity}}data-content="{{$.i18n.Tr "settings.key_state_desc"}}" data-variation="inverted tiny"{{end}}>{{svg "octicon-key" 32}}</span>
25+
</div>
26+
<div class="content">
27+
<strong>{{.Name}}</strong>
28+
<div class="print meta">
29+
{{.Fingerprint}}
30+
</div>
31+
<div class="activity meta">
32+
<i>{{$.i18n.Tr "settings.add_on"}} <span>{{.CreatedUnix.FormatShort}}</span> — {{svg "octicon-info"}} {{if .HasUsed}}{{$.i18n.Tr "settings.last_used"}} <span {{if .HasRecentActivity}}class="green"{{end}}>{{.UpdatedUnix.FormatShort}}</span>{{else}}{{$.i18n.Tr "settings.no_activity"}}{{end}}</i>
33+
</div>
34+
</div>
3535
</div>
3636
{{end}}
3737
</div>

0 commit comments

Comments
 (0)