engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

repo-forks: stable, security, fix issue when forging fork_repo_id could allow reading other people forks.

Browse source
This commit is contained in:
Marcin Kuzminski 2017-10-26 10:14:38 +02:00
parent 3df3815e09
commit ce2de33a5a
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
rhodecode/controllers/forks.py
View file

@ -163,10 +163,13 @@ class ForksController(BaseRepoController):
_form = RepoForkForm(old_data={'repo_type': c.repo_info.repo_type}, _form = RepoForkForm(old_data={'repo_type': c.repo_info.repo_type},
repo_groups=c.repo_groups_choices, repo_groups=c.repo_groups_choices,
landing_revs=c.landing_revs_choices)() landing_revs=c.landing_revs_choices)()
post_data = dict(request.POST)
post_data['fork_parent_id'] = c.repo_info.repo_id
form_result = {} form_result = {}
task_id = None task_id = None
try: try:
form_result = _form.to_python(dict(request.POST)) form_result = _form.to_python(post_data)
# create fork is done sometimes async on celery, db transaction # create fork is done sometimes async on celery, db transaction
# management is handled there. # management is handled there.
task = RepoModel().create_fork( task = RepoModel().create_fork(