Permalink
Browse files

Merge 'v2.4.2'

* v2.4.2:
  Release notes for 2.4.2
  Release notes for 2.3.1
  Release notes for 2.2.2.2
  Fix permissions bug caused by directly inheriting from All-Projects

Change-Id: Iecd10b7b16ebda71bf88b600e73e09f147303009
  • Loading branch information...
2 parents b100330 + d2cacd1 commit b5274297040b7f7d3dfa929c036bc54396f8c0e7 @spearce spearce committed Jun 21, 2012
@@ -0,0 +1,24 @@
+Release notes for Gerrit 2.2.2.2
+================================
+
+Gerrit 2.2.2.2 is now available:
+
+link:http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.2.2.2.war[http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.2.2.2.war]
+
+There are no schema changes from 2.2.2, or 2.2.2.1.
+
+However, if upgrading from anything earlier, follow the upgrade
+procedure in the 2.2.2 link:ReleaseNotes-2.2.2.html[ReleaseNotes].
+
+Security Fixes
+--------------
+* Some access control sections may be ignored
++
+Gerrit sometimes ignored an access control section in a project
+if the exact same section name appeared in All-Projects. The bug
+required an unrelated project to have access.inheritFrom set to
+All-Projects and be accessed before the project that has the same
+section name as All-Projects. This is an unlikely scenario for
+most servers, as Gerrit does not normally set inheritFrom equal to
+All-Projects. The usual behavior is to not supply this property in
+project.config, and permit the implicit inheritence to take place.
@@ -0,0 +1,24 @@
+Release notes for Gerrit 2.3.1
+==============================
+
+Gerrit 2.3.1 is now available:
+
+link:http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.3.1.war[http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.3.1.war]
+
+There are no schema changes from 2.3.
+
+However, if upgrading from anything earlier, follow the upgrade
+procedure in the 2.3 link:ReleaseNotes-2.3.html[ReleaseNotes].
+
+Security Fixes
+--------------
+* Some access control sections may be ignored
++
+Gerrit sometimes ignored an access control section in a project
+if the exact same section name appeared in All-Projects. The bug
+required an unrelated project to have access.inheritFrom set to
+All-Projects and be accessed before the project that has the same
+section name as All-Projects. This is an unlikely scenario for
+most servers, as Gerrit does not normally set inheritFrom equal to
+All-Projects. The usual behavior is to not supply this property in
+project.config, and permit the implicit inheritence to take place.
@@ -0,0 +1,24 @@
+Release notes for Gerrit 2.4.2
+==============================
+
+Gerrit 2.4.2 is now available:
+
+link:http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.4.2.war[http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.4.2.war]
+
+There are no schema changes from 2.4, or 2.4.1.
+
+However, if upgrading from anything earlier, follow the upgrade
+procedure in the 2.4 link:ReleaseNotes-2.4.html[ReleaseNotes].
+
+Security Fixes
+--------------
+* Some access control sections may be ignored
++
+Gerrit sometimes ignored an access control section in a project
+if the exact same section name appeared in All-Projects. The bug
+required an unrelated project to have access.inheritFrom set to
+All-Projects and be accessed before the project that has the same
+section name as All-Projects. This is an unlikely scenario for
+most servers, as Gerrit does not normally set inheritFrom equal to
+All-Projects. The usual behavior is to not supply this property in
+project.config, and permit the implicit inheritence to take place.
View
@@ -4,18 +4,21 @@ Gerrit Code Review - Release Notes
[[2_4]]
Version 2.4.x
-------------
+* link:ReleaseNotes-2.4.2.html[2.4.2]
* link:ReleaseNotes-2.4.1.html[2.4.1]
* link:ReleaseNotes-2.4.html[2.4]
[[2_3]]
Version 2.3.x
-------------
* link:ReleaseNotes-2.3.html[2.3]
+* link:ReleaseNotes-2.3.1.html[2.3.1]
[[2_2]]
Version 2.2.x
-------------
* link:ReleaseNotes-2.2.2.html[2.2.2],
+* link:ReleaseNotes-2.2.2.2.html[2.2.2.2],
* link:ReleaseNotes-2.2.2.1.html[2.2.2.1],
* link:ReleaseNotes-2.2.1.html[2.2.1],
* link:ReleaseNotes-2.2.0.html[2.2.0]
@@ -214,6 +214,7 @@ public ProjectConfig getConfig() {
List<SectionMatcher> all = new ArrayList<SectionMatcher>();
Set<Project.NameKey> seen = new HashSet<Project.NameKey>();
+ ProjectState allProjects = projectCache.getAllProjects();
seen.add(getProject().getNameKey());
ProjectState s = this;
@@ -226,7 +227,9 @@ public ProjectConfig getConfig() {
}
s = projectCache.get(parent);
} while (s != null);
- all.addAll(projectCache.getAllProjects().getLocalAccessSections());
+ if (seen.add(allProjects.getProject().getNameKey())) {
+ all.addAll(allProjects.getLocalAccessSections());
+ }
return all;
}
@@ -23,6 +23,9 @@
import com.google.inject.Singleton;
import com.google.inject.name.Named;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
import java.util.Arrays;
import java.util.Collections;
import java.util.IdentityHashMap;
@@ -31,6 +34,9 @@
/** Caches the order AccessSections should be sorted for evaluation. */
@Singleton
public class SectionSortCache {
+ private static final Logger log =
+ LoggerFactory.getLogger(SectionSortCache.class);
+
private static final String CACHE_NAME = "permission_sort";
public static Module module() {
@@ -70,10 +76,11 @@ void sort(String ref, List<AccessSection> sections) {
}
} else {
+ boolean poison = false;
IdentityHashMap<AccessSection, Integer> srcMap =
new IdentityHashMap<AccessSection, Integer>();
for (int i = 0; i < cnt; i++) {
- srcMap.put(sections.get(i), i);
+ poison |= srcMap.put(sections.get(i), i) != null;
}
Collections.sort(sections, new MostSpecificComparator(ref));
@@ -88,7 +95,11 @@ void sort(String ref, List<AccessSection> sections) {
}
}
- cache.put(key, new EntryVal(srcIdx));
+ if (poison) {
+ log.error("Received duplicate AccessSection instances, not caching sort");
+ } else {
+ cache.put(key, new EntryVal(srcIdx));
+ }
}
}
@@ -144,6 +144,18 @@ public void testInheritRead_SingleBranchDoesNotOverrideInherited() {
u.controlForRef("refs/heads/foobar").canUpload());
}
+ public void testInheritDuplicateSections() {
+ grant(parent, READ, admin, "refs/*");
+ grant(local, READ, devs, "refs/heads/*");
+ local.getProject().setParentName(parent.getProject().getName());
+ assertTrue("a can read", user("a", admin).isVisible());
+
+ local = new ProjectConfig(new Project.NameKey("local"));
+ local.createInMemory();
+ grant(local, READ, devs, "refs/*");
+ assertTrue("d can read", user("d", devs).isVisible());
+ }
+
public void testInheritRead_OverrideWithDeny() {
grant(parent, READ, registered, "refs/*");
grant(local, READ, registered, "refs/*").setDeny();
@@ -320,7 +332,6 @@ public void setUp() throws Exception {
local = new ProjectConfig(new Project.NameKey("local"));
local.createInMemory();
- local.getProject().setParentName(parent.getProject().getName());
Cache<SectionSortCache.EntryKey, SectionSortCache.EntryVal> c =
CacheBuilder.newBuilder().build();

0 comments on commit b527429

Please sign in to comment.