engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pull-requests: security double check permissions on injected forms of source and target repositories.

Browse source
This commit is contained in:
Marcin Lulek 2017-10-17 20:32:59 +02:00
parent e6fa851ff8
commit 35981bbe7a
1 changed files with 32 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

33
rhodecode/apps/repository/views/repo_pull_requests.py
View file

@ -36,7 +36,8 @@ from rhodecode.lib import helpers as h, diffs, codeblocks, channelstream
from rhodecode.lib.base import vcs_operation_context
from rhodecode.lib.ext_json import json
from rhodecode.lib.auth import (
LoginRequired, HasRepoPermissionAnyDecorator, NotAnonymous, CSRFRequired)
LoginRequired, HasRepoPermissionAny, HasRepoPermissionAnyDecorator,
NotAnonymous, CSRFRequired)
from rhodecode.lib.utils2 import str2bool, safe_str, safe_unicode
from rhodecode.lib.vcs.backends.base import EmptyCommit, UpdateFailureReason
from rhodecode.lib.vcs.exceptions import (CommitDoesNotExistError,
@ -772,6 +773,36 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
source_db_repo = Repository.get_by_repo_name(_form['source_repo'])
target_db_repo = Repository.get_by_repo_name(_form['target_repo'])
# re-check permissions again here
# source_repo we must have read permissions
source_perm = HasRepoPermissionAny(
'repository.read',
'repository.write', 'repository.admin')(source_db_repo.repo_name)
if not source_perm:
msg = _('Not Enough permissions to source repo `{}`.'.format(
source_db_repo.repo_name))
h.flash(msg, category='error')
# copy the args back to redirect
org_query = self.request.GET.mixed()
raise HTTPFound(
h.route_path('pullrequest_new', repo_name=self.db_repo_name,
_query=org_query))
# target repo we must have write permissions, and also later on
# we want to check branch permissions here
target_perm = HasRepoPermissionAny(
'repository.write', 'repository.admin')(target_db_repo.repo_name)
if not target_perm:
msg = _('Not Enough permissions to target repo `{}`.'.format(
target_db_repo.repo_name))
h.flash(msg, category='error')
# copy the args back to redirect
org_query = self.request.GET.mixed()
raise HTTPFound(
h.route_path('pullrequest_new', repo_name=self.db_repo_name,
_query=org_query))
source_scm = source_db_repo.scm_instance()
target_scm = target_db_repo.scm_instance()