From 1addb7b6e263147c8d134b649171c7f29ac23766 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Thu, 7 Nov 2019 13:21:42 +0100 Subject: [PATCH] security: fixed issues with exposing repository names using global PR redirection link logic. - Since redirect was created to repository which linked to the PR, users who didn't have permissions to those repos could still see the name in the url generated. --- rhodecode/apps/admin/views/main_views.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/rhodecode/apps/admin/views/main_views.py b/rhodecode/apps/admin/views/main_views.py index 752b305c..3b847f62 100644 --- a/rhodecode/apps/admin/views/main_views.py +++ b/rhodecode/apps/admin/views/main_views.py @@ -25,7 +25,7 @@ from pyramid.view import view_config from rhodecode.apps._base import BaseAppView from rhodecode.lib import helpers as h -from rhodecode.lib.auth import (LoginRequired, NotAnonymous) +from rhodecode.lib.auth import (LoginRequired, NotAnonymous, HasRepoPermissionAny) from rhodecode.model.db import PullRequest @@ -66,6 +66,13 @@ class AdminMainView(BaseAppView): pull_request_id = pull_request.pull_request_id repo_name = pull_request.target_repo.repo_name + # NOTE(marcink): + # check permissions so we don't redirect to repo that we don't have access to + # exposing it's name + target_repo_perm = HasRepoPermissionAny( + 'repository.read', 'repository.write', 'repository.admin')(repo_name) + if not target_repo_perm: + raise HTTPNotFound() raise HTTPFound( h.route_path('pullrequest_show', repo_name=repo_name,