You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2026/06/04 19:01:27 UTC
(allura) branch master updated (b8de78dbb -> c6f48a4ae)
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
from b8de78dbb [#8606] Add encrypted field for email from the EmailAddress model
new 2a8179312 [#8607] another perm check for MRs
new c6f48a4ae [#8607] lock down get_markdown content type and only to those who could use it to update anyway
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
Allura/allura/controllers/discuss.py | 3 ++-
Allura/allura/controllers/repository.py | 4 +++-
Allura/allura/tests/functional/test_discuss.py | 1 +
ForgeBlog/forgeblog/main.py | 3 ++-
ForgeBlog/forgeblog/tests/functional/test_root.py | 1 +
ForgeGit/forgegit/tests/functional/test_controllers.py | 12 ++++++++++++
ForgeTracker/forgetracker/tests/functional/test_root.py | 1 +
ForgeTracker/forgetracker/tracker_main.py | 3 ++-
ForgeWiki/forgewiki/tests/functional/test_root.py | 1 +
ForgeWiki/forgewiki/wiki_main.py | 3 ++-
10 files changed, 27 insertions(+), 5 deletions(-)
(allura) 02/02: [#8607] lock down get_markdown content type and only to those who could use it to update anyway
Posted by br...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
commit c6f48a4ae209ad54b8e3d2be3ad91d3788aeda88
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Thu Jun 4 14:30:12 2026 -0400
[#8607] lock down get_markdown content type and only to those who could use it to update anyway
---
Allura/allura/controllers/discuss.py | 3 ++-
Allura/allura/controllers/repository.py | 3 ++-
Allura/allura/tests/functional/test_discuss.py | 1 +
ForgeBlog/forgeblog/main.py | 3 ++-
ForgeBlog/forgeblog/tests/functional/test_root.py | 1 +
ForgeGit/forgegit/tests/functional/test_controllers.py | 1 +
ForgeTracker/forgetracker/tests/functional/test_root.py | 1 +
ForgeTracker/forgetracker/tracker_main.py | 3 ++-
ForgeWiki/forgewiki/tests/functional/test_root.py | 1 +
ForgeWiki/forgewiki/wiki_main.py | 3 ++-
10 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/Allura/allura/controllers/discuss.py b/Allura/allura/controllers/discuss.py
index 9340916f9..5aceca93f 100644
--- a/Allura/allura/controllers/discuss.py
+++ b/Allura/allura/controllers/discuss.py
@@ -398,9 +398,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.post, 'moderate')
return self.post.text
@expose('json:')
diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py
index 228142500..de6b72ece 100644
--- a/Allura/allura/controllers/repository.py
+++ b/Allura/allura/controllers/repository.py
@@ -551,9 +551,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.req, 'write')
return self.req.description
@expose()
diff --git a/Allura/allura/tests/functional/test_discuss.py b/Allura/allura/tests/functional/test_discuss.py
index 7592c870e..6d3bd0251 100644
--- a/Allura/allura/tests/functional/test_discuss.py
+++ b/Allura/allura/tests/functional/test_discuss.py
@@ -209,6 +209,7 @@ def test_comment_get_markdown(self):
post_id = str(
r.html.find('div', {'class': 'discussion-post'})['id'])
response = self.app.get(self._thread_link() + post_id + '/get_markdown')
+ assert response.content_type == 'text/plain'
assert 'This is a post' in response
def test_comment_update_markdown(self):
diff --git a/ForgeBlog/forgeblog/main.py b/ForgeBlog/forgeblog/main.py
index 9dce9b057..02b0596a4 100644
--- a/ForgeBlog/forgeblog/main.py
+++ b/ForgeBlog/forgeblog/main.py
@@ -473,9 +473,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.post, 'edit')
return self.post.text
@without_trailing_slash
diff --git a/ForgeBlog/forgeblog/tests/functional/test_root.py b/ForgeBlog/forgeblog/tests/functional/test_root.py
index b5c5ccd24..79bed33fc 100644
--- a/ForgeBlog/forgeblog/tests/functional/test_root.py
+++ b/ForgeBlog/forgeblog/tests/functional/test_root.py
@@ -165,6 +165,7 @@ def test_post_get_markdown(self):
self._post()
d = self._blog_date()
response = self.app.get('/blog/%s/my-post/get_markdown' % d)
+ assert response.content_type == 'text/plain'
assert 'Nothing' in response
def test_post_update_markdown(self):
diff --git a/ForgeGit/forgegit/tests/functional/test_controllers.py b/ForgeGit/forgegit/tests/functional/test_controllers.py
index e2bf0d00c..fb986710a 100644
--- a/ForgeGit/forgegit/tests/functional/test_controllers.py
+++ b/ForgeGit/forgegit/tests/functional/test_controllers.py
@@ -962,6 +962,7 @@ def test_merge_request_get_markdown(self):
'description': 'description',
})
response = self.app.get('/p/test/src-git/merge-requests/1/get_markdown')
+ assert response.content_type == 'text/plain'
assert 'description' in response
def test_merge_request_update_markdown(self):
diff --git a/ForgeTracker/forgetracker/tests/functional/test_root.py b/ForgeTracker/forgetracker/tests/functional/test_root.py
index acd307dc1..528a81a77 100644
--- a/ForgeTracker/forgetracker/tests/functional/test_root.py
+++ b/ForgeTracker/forgetracker/tests/functional/test_root.py
@@ -298,6 +298,7 @@ def test_new_ticket(self):
def test_ticket_get_markdown(self):
self.new_ticket(summary='my ticket', description='my description')
response = self.app.get('/bugs/1/get_markdown')
+ assert response.content_type == 'text/plain'
assert 'my description' in response
def test_ticket_update_markdown(self):
diff --git a/ForgeTracker/forgetracker/tracker_main.py b/ForgeTracker/forgetracker/tracker_main.py
index a3482cf70..3160b6b35 100644
--- a/ForgeTracker/forgetracker/tracker_main.py
+++ b/ForgeTracker/forgetracker/tracker_main.py
@@ -1573,9 +1573,10 @@ def update_markdown(self, text=None, **kw):
'status': 'no_permission'
}
- @expose()
+ @expose(content_type='text/plain')
@without_trailing_slash
def get_markdown(self):
+ require_access(self.ticket, 'update')
return self.ticket.description
@expose('json:')
diff --git a/ForgeWiki/forgewiki/tests/functional/test_root.py b/ForgeWiki/forgewiki/tests/functional/test_root.py
index 7b5b30a4f..0fba9054b 100644
--- a/ForgeWiki/forgewiki/tests/functional/test_root.py
+++ b/ForgeWiki/forgewiki/tests/functional/test_root.py
@@ -432,6 +432,7 @@ def test_page_get_markdown(self):
'labels': '',
})
response = self.app.get(h.urlquote('/wiki/tést/get_markdown'))
+ assert response.content_type == 'text/plain'
assert '- [ ] checkbox' in response
def test_page_update_markdown(self):
diff --git a/ForgeWiki/forgewiki/wiki_main.py b/ForgeWiki/forgewiki/wiki_main.py
index d93d56feb..c2c93b50c 100644
--- a/ForgeWiki/forgewiki/wiki_main.py
+++ b/ForgeWiki/forgewiki/wiki_main.py
@@ -818,8 +818,9 @@ def update_markdown(self, text=None, **kw):
}
@without_trailing_slash
- @expose()
+ @expose(content_type='text/plain')
def get_markdown(self):
+ require_access(self.page, 'edit')
return self.page.text
@without_trailing_slash
(allura) 01/02: [#8607] another perm check for MRs
Posted by br...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
commit 2a81793127a338b96521b26d416bdb219d2ad890
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Thu Jun 4 14:12:27 2026 -0400
[#8607] another perm check for MRs
---
Allura/allura/controllers/repository.py | 1 +
ForgeGit/forgegit/tests/functional/test_controllers.py | 11 +++++++++++
2 files changed, 12 insertions(+)
diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py
index 6be33c3fb..228142500 100644
--- a/Allura/allura/controllers/repository.py
+++ b/Allura/allura/controllers/repository.py
@@ -193,6 +193,7 @@ def request_merge(self, branch=None, **kw):
@expose('jinja:allura:templates/repo/request_merge.html') # needed when we "return self.request_merge(...)"
@require_post()
def do_request_merge(self, **kw):
+ require_access(c.app.repo, 'admin')
try:
kw = self.mr_widget.to_python(kw)
except formencode.Invalid:
diff --git a/ForgeGit/forgegit/tests/functional/test_controllers.py b/ForgeGit/forgegit/tests/functional/test_controllers.py
index e6cfa1eee..e2bf0d00c 100644
--- a/ForgeGit/forgegit/tests/functional/test_controllers.py
+++ b/ForgeGit/forgegit/tests/functional/test_controllers.py
@@ -746,6 +746,17 @@ def test_merge_action_unavailable_to_non_admin(self):
'/p/test2/code/request_merge',
status=403, extra_environ=dict(username='test-user'))
+ def test_do_request_merge_unavailable_to_non_admin(self):
+ self.app.post(
+ '/p/test2/code/do_request_merge',
+ params={
+ 'source_branch': 'zz',
+ 'target_branch': 'master',
+ 'summary': 'summary',
+ 'description': 'description',
+ },
+ status=403, extra_environ=dict(username='test-user'))
+
def test_merge_request_detail_view(self):
r, mr_num = self._request_merge()
assert 'wants to merge' in r