You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2026/05/26 20:56:43 UTC
(allura) 27/33: [#8607] remove potential info disclosure
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch db/8607
in repository https://gitbox.apache.org/repos/asf/allura.git
commit 01f39777e60a903526b439e02cf9d9b9f216005a
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Fri May 22 15:49:07 2026 -0400
[#8607] remove potential info disclosure
---
Allura/allura/controllers/repository.py | 7 ++++++-
Allura/allura/controllers/rest.py | 2 +-
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py
index 111ba510a..3cd059f91 100644
--- a/Allura/allura/controllers/repository.py
+++ b/Allura/allura/controllers/repository.py
@@ -45,6 +45,7 @@
from allura.lib import widgets as w
from allura.lib.decorators import require_post, memorable_forget
from allura.lib.diff import HtmlSideBySideDiff
+from allura.lib.exceptions import ForgeError
from allura.lib.security import require_access, require_authenticated, has_access
from allura.lib.widgets import form_fields as ffw
from allura.lib.widgets.repo import SCMLogWidget, SCMRevisionWidget, SCMTreeWidget
@@ -150,9 +151,13 @@ def fork(self, project_id=None, mount_point=None, mount_label=None, **kw):
redirect(to_project.url() + mount_point + '/')
except exc.HTTPRedirection:
raise
- except Exception as ex:
+ except ForgeError as ex:
flash(str(ex), 'error')
redirect(six.ensure_text(request.referer or '/'))
+ except Exception as ex:
+ log.exception('Error forking repo')
+ flash('Error forking repo', 'error')
+ redirect(six.ensure_text(request.referer or '/'))
@property
def mr_widget(self):
diff --git a/Allura/allura/controllers/rest.py b/Allura/allura/controllers/rest.py
index 15a109c40..7613ac4fb 100644
--- a/Allura/allura/controllers/rest.py
+++ b/Allura/allura/controllers/rest.py
@@ -422,7 +422,7 @@ def _authenticate(self):
request.environ.get('HTTP_X_FORWARDED_PROTO') == 'https',
debug)):
request.environ['tg.status_code_redirect'] = True
- raise exc.HTTPUnauthorized('HTTPS is required to use bearer tokens %s' % request.environ)
+ raise exc.HTTPUnauthorized('HTTPS is required to use bearer tokens')
access_token = M.OAuthAccessToken.query.get(api_key=access_token)
if not (access_token and access_token.is_bearer):
request.environ['tg.status_code_redirect'] = True