From 3df3815e094a2fe35391706a7df11b9816ef5ef6 Mon Sep 17 00:00:00 2001
From: Marcin Lulek <mlulek@rhodecode.com>
Date: Sun, 8 Oct 2017 23:31:45 +0200
Subject: [PATCH] auth: don't expose full set of permissions into channelstream
 payload. This leads to resource discovery security vulnerability

---
 rhodecode/apps/channelstream/views.py |  3 ++-
 rhodecode/lib/auth.py                 | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/rhodecode/apps/channelstream/views.py b/rhodecode/apps/channelstream/views.py
index e0b09d4b..5c90f5eb 100644
--- a/rhodecode/apps/channelstream/views.py
+++ b/rhodecode/apps/channelstream/views.py
@@ -71,6 +71,7 @@ class ChannelstreamView(object):
         except Exception:
             log.exception('Failed to decode json from request')
             raise HTTPBadRequest()
+
         try:
             channels = check_channel_permissions(
                 json_body.get('channels'),
@@ -92,7 +93,7 @@ class ChannelstreamView(object):
                 'display_name': None,
                 'display_link': None,
             }
-        user_data['permissions'] = self._rhodecode_user.permissions
+        user_data['permissions'] = self._rhodecode_user.permissions_safe
         payload = {
             'username': user.username,
             'user_state': user_data,
diff --git a/rhodecode/lib/auth.py b/rhodecode/lib/auth.py
index 6d237c0b..23bbee88 100644
--- a/rhodecode/lib/auth.py
+++ b/rhodecode/lib/auth.py
@@ -824,6 +824,24 @@ class AuthUser(object):
     def permissions(self):
         return self.get_perms(user=self, cache=False)
 
+    @LazyProperty
+    def permissions_safe(self):
+        """
+        Filtered permissions excluding not allowed repositories
+        """
+        perms = self.get_perms(user=self, cache=False)
+
+        perms['repositories'] = {
+            k: v for k, v in perms['repositories'].iteritems()
+            if v != 'repository.none'}
+        perms['repositories_groups'] = {
+            k: v for k, v in perms['repositories_groups'].iteritems()
+            if v != 'group.none'}
+        perms['user_groups'] = {
+            k: v for k, v in perms['user_groups'].iteritems()
+            if v != 'usergroup.none'}
+        return perms
+
     def permissions_with_scope(self, scope):
         """
         Call the get_perms function with scoped data. The scope in that function