From ffb80aaa1a3f6c175e9bff315b8bee3b3523d027 Mon Sep 17 00:00:00 2001 From: Marcin Lulek Date: Tue, 20 Jun 2017 19:39:19 +0200 Subject: [PATCH] security: use 404 instead of 403 in case missing permissions for comment deletion. - prevents resource discovery --- rhodecode/controllers/changeset.py | 4 +++- rhodecode/controllers/pullrequests.py | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/rhodecode/controllers/changeset.py b/rhodecode/controllers/changeset.py index 772afb72..cd5a8ee3 100644 --- a/rhodecode/controllers/changeset.py +++ b/rhodecode/controllers/changeset.py @@ -448,7 +448,9 @@ class ChangesetController(BaseRepoController): Session().commit() return True else: - raise HTTPForbidden() + log.warning('No permissions for user %s to delete comment_id: %s', + c.rhodecode_user, comment_id) + raise HTTPNotFound() @LoginRequired() @HasRepoPermissionAnyDecorator('repository.read', 'repository.write', diff --git a/rhodecode/controllers/pullrequests.py b/rhodecode/controllers/pullrequests.py index 72fc717f..9cec339d 100644 --- a/rhodecode/controllers/pullrequests.py +++ b/rhodecode/controllers/pullrequests.py @@ -1013,4 +1013,6 @@ class PullrequestsController(BaseRepoController): comment.pull_request, c.rhodecode_user, 'review_status_change') return True else: - raise HTTPForbidden() + log.warning('No permissions for user %s to delete comment_id: %s', + c.rhodecode_user, comment_id) + raise HTTPNotFound()