Page MenuHomePhabricator

Prevent Repository local path edit from the web UI
ClosedPublic

Authored by epriestley on Nov 13 2013, 5:33 PM.
Tags
None
Referenced Files
F14069504: D7580.diff
Wed, Nov 20, 7:38 AM
F14056476: D7580.id17110.diff
Sat, Nov 16, 8:41 PM
F14056475: D7580.id17104.diff
Sat, Nov 16, 8:41 PM
F14056474: D7580.id.diff
Sat, Nov 16, 8:41 PM
F14056473: D7580.diff
Sat, Nov 16, 8:41 PM
F14036424: D7580.diff
Sun, Nov 10, 10:13 AM
F14021055: D7580.diff
Wed, Nov 6, 4:58 AM
F13986736: D7580.diff
Oct 21 2024, 5:10 AM
Subscribers

Details

Summary

Ref T4039. This fixes an issue where a user with the ability to create repositories could view repositories he is otherwise not permitted to see, by following these steps:

  • Suppose you want to see repository "A".
  • Create a repository with the same VCS, called "B".
  • Edit the local path, changing "/var/repo/B" to "/var/repo/A".
  • Now it points at a working copy of a repository you can't see.
  • Although you won't be able to make it through discovery (the pull will fail with the wrong credentials), you can read some information out of the repository directly through the Diffusion UI, probably?

I'm not sure this was really practical to execute since there are a bunch of sanity checks along most/all of the major pathways, but lock it down since normal users shouldn't be editing it anyway. In the best case, this would make a mess.

Test Plan

{F81391}

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped