engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

api: validate commit_id when using commit_comment API

Browse source
This commit is contained in:
Marcin Kuzminski 2017-02-08 21:30:23 +01:00
parent aa55532833
commit a2de6540c6
2 changed files with 31 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
rhodecode/api/views/repo_api.py
View file

@ -30,9 +30,9 @@ from rhodecode.api.utils import (
get_perm_or_error, parse_args, get_origin, build_commit_data,
validate_set_owner_permissions)
from rhodecode.lib.auth import HasPermissionAnyApi, HasUserGroupPermissionAnyApi
from rhodecode.lib.exceptions import StatusChangeOnClosedPullRequestError
from rhodecode.lib.utils2 import str2bool, time_to_datetime
from rhodecode.lib.ext_json import json
from rhodecode.lib.exceptions import StatusChangeOnClosedPullRequestError
from rhodecode.model.changeset_status import ChangesetStatusModel
from rhodecode.model.comment import CommentsModel
from rhodecode.model.db import (
@ -1426,6 +1426,12 @@ def comment_commit(
_perms = ('repository.read', 'repository.write', 'repository.admin')
validate_repo_permissions(apiuser, repoid, repo, _perms)
try:
commit_id = repo.scm_instance().get_commit(commit_id=commit_id).raw_id
except Exception as e:
log.exception('Failed to fetch commit')
raise JSONRPCError(e.message)
if isinstance(userid, Optional):
userid = apiuser.user_id