mirror of
https://we.phorge.it/source/phorge.git
synced 2024-11-15 11:22:40 +01:00
2dc8065d11
Summary: Ref T4039. This fixes an issue where a user with the ability to create repositories could view repositories he is otherwise not permitted to see, by following these steps: - Suppose you want to see repository "A". - Create a repository with the same VCS, called "B". - Edit the local path, changing "/var/repo/B" to "/var/repo/A". - Now it points at a working copy of a repository you can't see. - Although you won't be able to make it through discovery (the pull will fail with the wrong credentials), you can read some information out of the repository directly through the Diffusion UI, probably? I'm not sure this was really practical to execute since there are a bunch of sanity checks along most/all of the major pathways, but lock it down since normal users shouldn't be editing it anyway. In the best case, this would make a mess. Test Plan: {F81391} Reviewers: btrahan Reviewed By: btrahan CC: aran Maniphest Tasks: T4039 Differential Revision: https://secure.phabricator.com/D7580
79 lines
2.2 KiB
PHP
79 lines
2.2 KiB
PHP
<?php
|
|
|
|
final class DiffusionRepositoryEditLocalController
|
|
extends DiffusionRepositoryEditController {
|
|
|
|
public function processRequest() {
|
|
$request = $this->getRequest();
|
|
$user = $request->getUser();
|
|
$drequest = $this->diffusionRequest;
|
|
$repository = $drequest->getRepository();
|
|
|
|
$repository = id(new PhabricatorRepositoryQuery())
|
|
->setViewer($user)
|
|
->requireCapabilities(
|
|
array(
|
|
PhabricatorPolicyCapability::CAN_VIEW,
|
|
PhabricatorPolicyCapability::CAN_EDIT,
|
|
))
|
|
->withIDs(array($repository->getID()))
|
|
->executeOne();
|
|
|
|
if (!$repository) {
|
|
return new Aphront404Response();
|
|
}
|
|
|
|
$edit_uri = $this->getRepositoryControllerURI($repository, 'edit/');
|
|
|
|
$v_local = $repository->getHumanReadableDetail('local-path');
|
|
$errors = array();
|
|
|
|
$crumbs = $this->buildApplicationCrumbs();
|
|
$crumbs->addCrumb(
|
|
id(new PhabricatorCrumbView())
|
|
->setName(pht('Edit Local')));
|
|
|
|
$title = pht('Edit %s', $repository->getName());
|
|
|
|
$error_view = null;
|
|
if ($errors) {
|
|
$error_view = id(new AphrontErrorView())
|
|
->setTitle(pht('Form Errors'))
|
|
->setErrors($errors);
|
|
}
|
|
|
|
$form = id(new AphrontFormView())
|
|
->setUser($user)
|
|
->appendRemarkupInstructions(
|
|
pht(
|
|
"You can not adjust the local path for this repository from the ".
|
|
"web interface. To edit it, run this command:\n\n".
|
|
" phabricator/ $ ./bin/repository edit %s --as %s --local-path ...",
|
|
$repository->getCallsign(),
|
|
$user->getUsername()))
|
|
->appendChild(
|
|
id(new AphrontFormMarkupControl())
|
|
->setName('local')
|
|
->setLabel(pht('Local Path'))
|
|
->setValue($v_local))
|
|
->appendChild(
|
|
id(new AphrontFormSubmitControl())
|
|
->addCancelButton($edit_uri, pht('Done')));
|
|
|
|
$object_box = id(new PHUIObjectBoxView())
|
|
->setHeaderText($title)
|
|
->setForm($form)
|
|
->setFormError($error_view);
|
|
|
|
return $this->buildApplicationPage(
|
|
array(
|
|
$crumbs,
|
|
$object_box,
|
|
),
|
|
array(
|
|
'title' => $title,
|
|
'device' => true,
|
|
));
|
|
}
|
|
|
|
}
|