From b32618991086b606ee82c0ce6c08db0684d10166 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sun, 15 Oct 2017 18:54:52 +0200 Subject: [PATCH] repo-forks: security, fix issue when forging fork_repo_id could allow reading other people forks. --- rhodecode/apps/admin/views/repositories.py | 1 + rhodecode/apps/repository/views/repo_forks.py | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/rhodecode/apps/admin/views/repositories.py b/rhodecode/apps/admin/views/repositories.py index 9a44ee4b..e4d33ba7 100644 --- a/rhodecode/apps/admin/views/repositories.py +++ b/rhodecode/apps/admin/views/repositories.py @@ -63,6 +63,7 @@ class AdminReposView(BaseAppView, DataGridAppView): @LoginRequired() @NotAnonymous() + # perms check inside @view_config( route_name='repos', request_method='GET', renderer='rhodecode:templates/admin/repos/repos.mako') diff --git a/rhodecode/apps/repository/views/repo_forks.py b/rhodecode/apps/repository/views/repo_forks.py index 318fe75d..1749c585 100644 --- a/rhodecode/apps/repository/views/repo_forks.py +++ b/rhodecode/apps/repository/views/repo_forks.py @@ -212,10 +212,15 @@ class RepoForksView(RepoAppView, DataGridAppView): _form = RepoForkForm(old_data={'repo_type': self.db_repo.repo_type}, repo_groups=c.repo_groups_choices, landing_revs=c.landing_revs_choices)() + post_data = dict(self.request.POST) + + # forbid injecting other repo by forging a request + post_data['fork_parent_id'] = self.db_repo.repo_id + form_result = {} task_id = None try: - form_result = _form.to_python(dict(self.request.POST)) + form_result = _form.to_python(post_data) # create fork is done sometimes async on celery, db transaction # management is handled there. task = RepoModel().create_fork(