[ARVADOS] updated: 40cedbe09d7e8fe3223ebe3da14d7d6983b22df1

git at public.curoverse.com git at public.curoverse.com
Thu Jun 12 11:14:11 EDT 2014


Summary of changes:
 .../controllers/arvados/v1/api_client_authorizations_controller.rb  | 6 ++++++
 1 file changed, 6 insertions(+)

       via  40cedbe09d7e8fe3223ebe3da14d7d6983b22df1 (commit)
      from  bba95a22451284c2d4d6787cd2e3fa98c3c21cdf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.


commit 40cedbe09d7e8fe3223ebe3da14d7d6983b22df1
Author: Peter Amstutz <peter.amstutz at curoverse.com>
Date:   Thu Jun 12 11:14:03 2014 -0400

    Made a note about user how permissions are applied when attempting to create a
    token for another user.  Test for this case already exists.  closes #2350.

diff --git a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
index 4a2bafd..76a228d 100644
--- a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
+++ b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
@@ -21,6 +21,12 @@ class Arvados::V1::ApiClientAuthorizationsController < ApplicationController
   end
 
   def create
+    # Note: the user could specify a owner_uuid for a different user, which on
+    # the surface appears to be a security hole.  However, the record will be
+    # rejected before being saved to the database by the ApiClientAuthorization
+    # model which enforces that user_id == current user or the user is an
+    # admin.
+
     if resource_attrs[:owner_uuid]
       # The model has an owner_id attribute instead of owner_uuid, but
       # we can't expect the client to know the local numeric ID. We

-----------------------------------------------------------------------


hooks/post-receive
-- 




More information about the arvados-commits mailing list