You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2026/06/04 19:01:29 UTC
(allura) 02/02: [#8607] lock down get_markdown content type and only to those who could use it to update anyway
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
commit c6f48a4ae209ad54b8e3d2be3ad91d3788aeda88
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Thu Jun 4 14:30:12 2026 -0400
[#8607] lock down get_markdown content type and only to those who could use it to update anyway
---
Allura/allura/controllers/discuss.py | 3 ++-
Allura/allura/controllers/repository.py | 3 ++-
Allura/allura/tests/functional/test_discuss.py | 1 +
ForgeBlog/forgeblog/main.py | 3 ++-
ForgeBlog/forgeblog/tests/functional/test_root.py | 1 +
ForgeGit/forgegit/tests/functional/test_controllers.py | 1 +
ForgeTracker/forgetracker/tests/functional/test_root.py | 1 +
ForgeTracker/forgetracker/tracker_main.py | 3 ++-
ForgeWiki/forgewiki/tests/functional/test_root.py | 1 +
ForgeWiki/forgewiki/wiki_main.py | 3 ++-
10 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/Allura/allura/controllers/discuss.py b/Allura/allura/controllers/discuss.py
index 9340916f9..5aceca93f 100644
--- a/Allura/allura/controllers/discuss.py
+++ b/Allura/allura/controllers/discuss.py
@@ -398,9 +398,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.post, 'moderate')
return self.post.text
@expose('json:')
diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py
index 228142500..de6b72ece 100644
--- a/Allura/allura/controllers/repository.py
+++ b/Allura/allura/controllers/repository.py
@@ -551,9 +551,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.req, 'write')
return self.req.description
@expose()
diff --git a/Allura/allura/tests/functional/test_discuss.py b/Allura/allura/tests/functional/test_discuss.py
index 7592c870e..6d3bd0251 100644
--- a/Allura/allura/tests/functional/test_discuss.py
+++ b/Allura/allura/tests/functional/test_discuss.py
@@ -209,6 +209,7 @@ def test_comment_get_markdown(self):
post_id = str(
r.html.find('div', {'class': 'discussion-post'})['id'])
response = self.app.get(self._thread_link() + post_id + '/get_markdown')
+ assert response.content_type == 'text/plain'
assert 'This is a post' in response
def test_comment_update_markdown(self):
diff --git a/ForgeBlog/forgeblog/main.py b/ForgeBlog/forgeblog/main.py
index 9dce9b057..02b0596a4 100644
--- a/ForgeBlog/forgeblog/main.py
+++ b/ForgeBlog/forgeblog/main.py
@@ -473,9 +473,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.post, 'edit')
return self.post.text
@without_trailing_slash
diff --git a/ForgeBlog/forgeblog/tests/functional/test_root.py b/ForgeBlog/forgeblog/tests/functional/test_root.py
index b5c5ccd24..79bed33fc 100644
--- a/ForgeBlog/forgeblog/tests/functional/test_root.py
+++ b/ForgeBlog/forgeblog/tests/functional/test_root.py
@@ -165,6 +165,7 @@ def test_post_get_markdown(self):
self._post()
d = self._blog_date()
response = self.app.get('/blog/%s/my-post/get_markdown' % d)
+ assert response.content_type == 'text/plain'
assert 'Nothing' in response
def test_post_update_markdown(self):
diff --git a/ForgeGit/forgegit/tests/functional/test_controllers.py b/ForgeGit/forgegit/tests/functional/test_controllers.py
index e2bf0d00c..fb986710a 100644
--- a/ForgeGit/forgegit/tests/functional/test_controllers.py
+++ b/ForgeGit/forgegit/tests/functional/test_controllers.py
@@ -962,6 +962,7 @@ def test_merge_request_get_markdown(self):
'description': 'description',
})
response = self.app.get('/p/test/src-git/merge-requests/1/get_markdown')
+ assert response.content_type == 'text/plain'
assert 'description' in response
def test_merge_request_update_markdown(self):
diff --git a/ForgeTracker/forgetracker/tests/functional/test_root.py b/ForgeTracker/forgetracker/tests/functional/test_root.py
index acd307dc1..528a81a77 100644
--- a/ForgeTracker/forgetracker/tests/functional/test_root.py
+++ b/ForgeTracker/forgetracker/tests/functional/test_root.py
@@ -298,6 +298,7 @@ def test_new_ticket(self):
def test_ticket_get_markdown(self):
self.new_ticket(summary='my ticket', description='my description')
response = self.app.get('/bugs/1/get_markdown')
+ assert response.content_type == 'text/plain'
assert 'my description' in response
def test_ticket_update_markdown(self):
diff --git a/ForgeTracker/forgetracker/tracker_main.py b/ForgeTracker/forgetracker/tracker_main.py
index a3482cf70..3160b6b35 100644
--- a/ForgeTracker/forgetracker/tracker_main.py
+++ b/ForgeTracker/forgetracker/tracker_main.py
@@ -1573,9 +1573,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.ticket, 'update')
return self.ticket.description
@expose('json:')
diff --git a/ForgeWiki/forgewiki/tests/functional/test_root.py b/ForgeWiki/forgewiki/tests/functional/test_root.py
index 7b5b30a4f..0fba9054b 100644
--- a/ForgeWiki/forgewiki/tests/functional/test_root.py
+++ b/ForgeWiki/forgewiki/tests/functional/test_root.py
@@ -432,6 +432,7 @@ def test_page_get_markdown(self):
'labels': '',
})
response = self.app.get(h.urlquote('/wiki/tést/get_markdown'))
+ assert response.content_type == 'text/plain'
assert '- [ ] checkbox' in response
def test_page_update_markdown(self):
diff --git a/ForgeWiki/forgewiki/wiki_main.py b/ForgeWiki/forgewiki/wiki_main.py
index d93d56feb..c2c93b50c 100644
--- a/ForgeWiki/forgewiki/wiki_main.py
+++ b/ForgeWiki/forgewiki/wiki_main.py
@@ -818,8 +818,9 @@ def update_markdown(self, text=None, **kw):
}
@without_trailing_slash
- @expose()
+ @expose(content_type='text/plain')
def get_markdown(self):
+ require_access(self.page, 'edit')
return self.page.text
@without_trailing_slash