[#8454] prevent anonymous github project imports
diff --git a/ForgeImporters/forgeimporters/github/__init__.py b/ForgeImporters/forgeimporters/github/__init__.py
index d0a4d26..34dab0a 100644
--- a/ForgeImporters/forgeimporters/github/__init__.py
+++ b/ForgeImporters/forgeimporters/github/__init__.py
@@ -226,6 +226,9 @@
'''
def oauth_begin(self, scope=None): # type: (list[str]) -> None
+ if c.user.is_anonymous():
+ log.info("User needs authorization before importing a project")
+ return None
client_id = config.get('github_importer.client_id')
secret = config.get('github_importer.client_secret')
if not client_id or not secret:
diff --git a/ForgeImporters/forgeimporters/tests/github/functional/test_github.py b/ForgeImporters/forgeimporters/tests/github/functional/test_github.py
index 0068e6e..57cb9b2 100644
--- a/ForgeImporters/forgeimporters/tests/github/functional/test_github.py
+++ b/ForgeImporters/forgeimporters/tests/github/functional/test_github.py
@@ -92,3 +92,9 @@
auth=requests.auth.HTTPBasicAuth('client_id', 'secret'),
json={'access_token': 'abc'},
timeout=10)
+
+
+ def test_project_import_login_required(self):
+ r = self.app.get('/p/import_project/github/', extra_environ=dict(username='*anonymous'))
+ assert_equal(None, r.location)
+ r.mustcontain('Login Required')
