[ARVADOS] updated: 40cedbe09d7e8fe3223ebe3da14d7d6983b22df1
git at public.curoverse.com
git at public.curoverse.com
Thu Jun 12 11:14:11 EDT 2014
Summary of changes:
.../controllers/arvados/v1/api_client_authorizations_controller.rb | 6 ++++++
1 file changed, 6 insertions(+)
via 40cedbe09d7e8fe3223ebe3da14d7d6983b22df1 (commit)
from bba95a22451284c2d4d6787cd2e3fa98c3c21cdf (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
commit 40cedbe09d7e8fe3223ebe3da14d7d6983b22df1
Author: Peter Amstutz <peter.amstutz at curoverse.com>
Date: Thu Jun 12 11:14:03 2014 -0400
Made a note about user how permissions are applied when attempting to create a
token for another user. Test for this case already exists. closes #2350.
diff --git a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
index 4a2bafd..76a228d 100644
--- a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
+++ b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
@@ -21,6 +21,12 @@ class Arvados::V1::ApiClientAuthorizationsController < ApplicationController
end
def create
+ # Note: the user could specify a owner_uuid for a different user, which on
+ # the surface appears to be a security hole. However, the record will be
+ # rejected before being saved to the database by the ApiClientAuthorization
+ # model which enforces that user_id == current user or the user is an
+ # admin.
+
if resource_attrs[:owner_uuid]
# The model has an owner_id attribute instead of owner_uuid, but
# we can't expect the client to know the local numeric ID. We
-----------------------------------------------------------------------
hooks/post-receive
--
More information about the arvados-commits
mailing list