Differential D7398
admin/origin_save: Do not modify unauthorized URLs list when rejecting Authored by anlambert on Mar 21 2022, 2:21 PM.
Details
When rejecting a Save Code Now request, the submitted origin URL was So remove the automatic adding of origin URL in unauthorized list
Diff Detail
Event TimelineComment Actions Build is green Patch application report for D7398 (id=26736)Rebasing onto f232481f96... Current branch diff-target is up to date. Changes applied before testcommit 2c761cbe75b6a685660f93a3e84ef4ec84e6aa56
Author: Antoine Lambert <anlambert@softwareheritage.org>
Date: Mon Mar 21 14:15:11 2022 +0100
admin/origin_save: Do not modify unauthorized URLs list when rejecting
When rejecting a Save Code Now request, the submitted origin URL was
automatically added to the unauthorized URLs list. But this was
prolematic as a valid URL prefix could be added in that list and
thus a valid request whose origin URL has that prefix would be
automatically rejected.
So remove the automatic adding of origin URL in unauthorized list
when rejecting a request.See https://jenkins.softwareheritage.org/job/DWAPPS/job/tests-on-diff/1515/ for more details. Comment Actions Build is green Patch application report for D7398 (id=26737)Rebasing onto f232481f96... Current branch diff-target is up to date. Changes applied before testcommit 6f4052cfb4f45f1a1f2cc47c714fee77fa916b69
Author: Antoine Lambert <anlambert@softwareheritage.org>
Date: Mon Mar 21 14:15:11 2022 +0100
admin/origin_save: Do not modify unauthorized URLs list when rejecting
When rejecting a Save Code Now request, the submitted origin URL was
automatically added to the unauthorized URLs list. But this was
prolematic as a valid URL prefix could be added in that list and
thus a valid request whose origin URL has that prefix would be
automatically rejected.
So remove the automatic adding of origin URL in unauthorized list
when rejecting a request.
Also return 404 in the reject endpoint when the request does not
exist.See https://jenkins.softwareheritage.org/job/DWAPPS/job/tests-on-diff/1516/ for more details. Comment Actions What made the old code deal with prefixes? From what I can see, it matches on the full URL Comment Actions Yes but users could have submitted an origin URL prefix through the Web API endpoint for SCN. So maybe the right solution is to check the submitted origin URL is not a prefix on the backend side ? Comment Actions
I think so, but we also should not add prefixes automatically. (Adding specific URLs+types automatically is fine though, it avoids refusing the same origin over and over) Comment Actions Build is green Patch application report for D7398 (id=26750)Rebasing onto 60666aa2d1... Current branch diff-target is up to date. Changes applied before testcommit 90f25e245864495cbc09ddc054ed1bf9cafeffeb
Author: Antoine Lambert <anlambert@softwareheritage.org>
Date: Mon Mar 21 14:15:11 2022 +0100
admin/origin_save: Do not modify unauthorized URLs list when rejecting
When rejecting a Save Code Now request, the submitted origin URL was
automatically added to the unauthorized URLs list. But this was
prolematic as a valid URL prefix could be added in that list and
thus a valid request whose origin URL has that prefix would be
automatically rejected.
So remove the automatic adding of origin URL in unauthorized list
when rejecting a request.
Also return 404 in the reject endpoint when the request does not
exist.See https://jenkins.softwareheritage.org/job/DWAPPS/job/tests-on-diff/1523/ for more details. Comment Actions Build is green Patch application report for D7398 (id=26768)Rebasing onto ac5e79103c... Current branch diff-target is up to date. Changes applied before testcommit 4b6f0654969a983a03d63a78445ee600cbb8c7ba
Author: Antoine Lambert <anlambert@softwareheritage.org>
Date: Thu Feb 3 13:49:19 2022 +0100
admin: Add mailmaps administration Web UI
Add a new administration view to manage the mailmaps in the
archive.
The view allows to add new mailmaps or update existing ones.
It requires a special user permission "swh.web.admin.mailmap"
to be used.
Only mailmaps created by users with that permission will be
displayed in that view.See https://jenkins.softwareheritage.org/job/DWAPPS/job/tests-on-diff/1531/ for more details. Comment Actions Build is green Patch application report for D7398 (id=26769)Rebasing onto ac5e79103c... Current branch diff-target is up to date. Changes applied before testcommit 36cc6f6154a242cfa1aaa77a3712bbbbe63b5690
Author: Antoine Lambert <anlambert@softwareheritage.org>
Date: Mon Mar 21 14:15:11 2022 +0100
admin/origin_save: Do not modify unauthorized URLs list when rejecting
When rejecting a Save Code Now request, the submitted origin URL was
automatically added to the unauthorized URLs list. But this was
prolematic as a valid URL prefix could be added in that list and
thus a valid request whose origin URL has that prefix would be
automatically rejected.
So remove the automatic adding of origin URL in unauthorized list
when rejecting a request.
Also return 404 in the reject endpoint when the request does not
exist.See https://jenkins.softwareheritage.org/job/DWAPPS/job/tests-on-diff/1532/ for more details. Comment Actions Build is green Patch application report for D7398 (id=26789)Rebasing onto d6605c7a7e... Current branch diff-target is up to date. Changes applied before testcommit 74a5fc48c82b0c144f752189ab83094c45f14d8e
Author: Antoine Lambert <anlambert@softwareheritage.org>
Date: Mon Mar 21 14:15:11 2022 +0100
admin/origin_save: Do not modify unauthorized URLs list when rejecting
When rejecting a Save Code Now request, the submitted origin URL was
automatically added to the unauthorized URLs list. But this was
prolematic as a valid URL prefix could be added in that list and
thus a valid request whose origin URL has that prefix would be
automatically rejected.
So remove the automatic adding of origin URL in unauthorized list
when rejecting a request.
Also return 404 in the reject endpoint when the request does not
exist.See https://jenkins.softwareheritage.org/job/DWAPPS/job/tests-on-diff/1537/ for more details. |