engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): do not expose draft comments via API to other users than caller

Browse source
This commit is contained in:
RhodeCode Admin 2025-02-24 08:41:01 +01:00
parent dc6fcb4c50
commit 2af828e1c9
2 changed files with 79 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

28
rhodecode/api/views/pull_request_api.py
View file

@ -39,7 +39,15 @@ from rhodecode.lib.utils2 import str2bool
from rhodecode.lib.vcs.backends.base import unicode_to_reference
from rhodecode.model.changeset_status import ChangesetStatusModel
from rhodecode.model.comment import CommentsModel
from rhodecode.model.db import Session, ChangesetStatus, ChangesetComment, PullRequest, PullRequestReviewers
from rhodecode.model.db import (
Session,
ChangesetStatus,
ChangesetComment,
PullRequest,
PullRequestReviewers,
false,
true,
)
from rhodecode.model.pull_request import PullRequestModel, MergeCheck
from rhodecode.model.settings import SettingsModel
from rhodecode.model.validation_schema import Invalid
@ -398,7 +406,7 @@ def get_pull_request_comments(request, apiuser, pullrequestid, repoid=Optional(N
repo = pull_request.target_repo
if not PullRequestModel().check_user_read(pull_request, apiuser, api=True):
raise JSONRPCError("repository `%s` or pull request `%s` does not exist" % (repoid, pullrequestid))
raise JSONRPCError(f"repository `{repoid}` or pull request `{pullrequestid}` does not exist")
(pull_request_latest, pull_request_at_ver, pull_request_display_obj, at_version) = (
PullRequestModel().get_pr_version(pull_request.pull_request_id, version=None)
@ -410,19 +418,29 @@ def get_pull_request_comments(request, apiuser, pullrequestid, repoid=Optional(N
# GENERAL COMMENTS with versions #
q = CommentsModel()._all_general_comments_of_pull_request(pull_request)
q = q.order_by(ChangesetComment.comment_id.asc())
q = q.filter(ChangesetComment.draft == false())
general_comments = q.all()
# INLINE COMMENTS with versions #
q = CommentsModel()._all_inline_comments_of_pull_request(pull_request)
q = q.order_by(ChangesetComment.comment_id.asc())
q = q.filter(ChangesetComment.draft == false())
inline_comments = q.all()
# INLINE DRAFT COMMENTS with versions #
q = CommentsModel()._all_inline_comments_of_pull_request(pull_request)
q = q.order_by(ChangesetComment.comment_id.asc())
q = q.filter(ChangesetComment.user_id == apiuser.user_id)
q = q.filter(ChangesetComment.draft == true())
inline_draft_comments = q.all()
log.error(q)
data = []
for comment in inline_comments + general_comments:
for comment in inline_draft_comments + inline_comments + general_comments:
full_data = comment.get_api_data()
pr_version_id = None
if comment.pull_request_version_id:
pr_version_id = "v{}".format(ver_map[comment.pull_request_version_id])
pr_version_id = f"v{ver_map[comment.pull_request_version_id]}"
# sanitize some entries
@ -566,7 +584,7 @@ def comment_pull_request(
text = message
status_label = ChangesetStatus.get_status_lbl(status)
if status and allowed_to_change_status:
st_message = "Status change %(transition_icon)s %(status)s" % {"transition_icon": ">", "status": status_label}
st_message = f"Status change > {status_label}"
text = message or st_message
rc_config = SettingsModel().get_all_settings()