Launchpad itself

SourcePackageRecipeBuild security needs work

Bug #552976 reported by William Grant
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
High
Aaron Bentley
Launchpad itself 10.04

Bug Description

SourcePackageRecipeBuild currently has no launchpad.View security adapter, so it is accessible to all authenticated users. It should be restricted by archive (and branch?) privacy. ViewBuildFarmJob also needs inspection -- although it seems to work at the moment, it uses ViewBuildRecord which assumes a binary build, so I don't see how it doesn't crash.

Related branches

lp:~abentley/launchpad/build-security
Tim Penhey (community): Approve
Diff: 139 lines (+64/-9)
3 files modified
lib/canonical/launchpad/security.py (+32/-6)
lib/lp/code/tests/test_sourcepackagerecipebuild.py (+29/-1)
lib/lp/testing/factory.py (+3/-2)
Revision history for this message
Paul Hummer (rockstar) wrote :

I'm adding this to our Kanban board in the area for tasks that need to be completed.

Changed in launchpad-code:
status: New → Triaged
importance: Undecided → High
Aaron Bentley (abentley)
Changed in launchpad-code:
assignee: nobody → Aaron Bentley (abentley)
Revision history for this message
Ursula Junque (ursinha) wrote : Bug fixed by a commit

Fixed in stable r10786 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/10786>

Changed in launchpad-code:
milestone: none → 10.04
status: Triaged → Fix Committed
tags: added: qa-needstesting
Tim Penhey (thumper)
Changed in launchpad-code:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.