Skip to content

Commit

Permalink
DEV: Add update message for an outdated mail-receiver
Browse files Browse the repository at this point in the history
Previous versions of the mail-receiver used query based api credentials,
if we detect this we will show a message in the admin panel to update
the mail receiver.
  • Loading branch information
oblakeerickson committed Nov 9, 2019
1 parent 63bd074 commit 15f6f57
Show file tree
Hide file tree
Showing 3 changed files with 12 additions and 3 deletions.
3 changes: 2 additions & 1 deletion app/models/admin_dashboard_data.rb
Expand Up @@ -85,7 +85,8 @@ def self.reset_problem_checks
'dashboard.bad_favicon_url',
'dashboard.poll_pop3_timeout',
'dashboard.poll_pop3_auth_error',
'dashboard.deprecated_api_usage'
'dashboard.deprecated_api_usage',
'dashboard.update_mail_receiver'
]

add_problem_check :rails_env_check, :host_names_check, :force_https_check,
Expand Down
1 change: 1 addition & 0 deletions config/locales/server.en.yml
Expand Up @@ -1339,6 +1339,7 @@ en:
missing_mailgun_api_key: "The server is configured to send emails via Mailgun but you haven't provided an API key used to verify the webhook messages."
bad_favicon_url: "The favicon is failing to load. Check your favicon setting in <a href='%{base_path}/admin/site_settings'>Site Settings</a>."
deprecated_api_usage: "We detected an API request using a deprecated authentication method. Please update it to use <a href='https://meta.discourse.org/t/discourse-api-documentation/22706'>header based auth</a>."
update_mail_receiver: "We detected an outdated version of mail-receiver. Please ssh into this server and run `/var/discourse/launcher rebuild mail-receiver`."
poll_pop3_timeout: "Connection to the POP3 server is timing out. Incoming email could not be retrieved. Please check your <a href='%{base_path}/admin/site_settings/category/email'>POP3 settings</a> and service provider."
poll_pop3_auth_error: "Connection to the POP3 server is failing with an authentication error. Please check your <a href='%{base_path}/admin/site_settings/category/email'>POP3 settings</a>."
force_https_warning: "Your website is using SSL. But `<a href='%{base_path}/admin/site_settings/category/all_results?filter=force_https'>force_https</a>` is not yet enabled in your site settings."
Expand Down
11 changes: 9 additions & 2 deletions lib/auth/default_current_user_provider.rb
Expand Up @@ -283,9 +283,16 @@ def lookup_user_api_user_and_update_key(user_api_key, client_id)
def lookup_api_user(api_key_value, request)
if api_key = ApiKey.active.where(key: api_key_value).includes(:user).first
api_username = header_api_key? ? @env[HEADER_API_USERNAME] : request[API_USERNAME]

# Check for deprecated api auth
if !header_api_key?
# Notify admins of deprecated auth method
AdminDashboardData.add_problem_message('dashboard.deprecated_api_usage', 1.day)
if request.path == "/admin/email/handle_mail"
# Notify admins that the mail receiver is still using query auth and to update
AdminDashboardData.add_problem_message('dashboard.update_mail_receiver', 1.day)
else
# Notify admins of deprecated auth method
AdminDashboardData.add_problem_message('dashboard.deprecated_api_usage', 1.day)
end
end

if api_key.allowed_ips.present? && !api_key.allowed_ips.any? { |ip| ip.include?(request.ip) }
Expand Down

1 comment on commit 15f6f57

@discoursereviewbot
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blake Erickson posted:

This change is related to this one:

Please sign in to comment.