[SECURITY ISSUE] Why can other people push my packages?

[leigh123linux]

The permissions seem buggered on the new bodhi

https://bodhi.fedoraproject.org/updates/tint2-0.12.2-1.fc22

thofmann pushed tint2 to testing (he has no perms for this action)

https://bodhi.fedoraproject.org/updates/tint2-0.12.2-1.fc22#comment-313306

In return I unpushed (I have no right or perms to do so).

https://bodhi.fedoraproject.org/updates/parcimonie.sh-0-0.4.20150804gitc009937.el7

[morxa]

I confirm: I can push and revoke updates without having the right permissions, see https://lists.fedoraproject.org/pipermail/devel/2015-August/213639.html

[lmacken]

Fixed in production. Please re-open if you still experience this issue.

[morxa]

There are still "Push to stable" buttons on updates where I should not have the permission to push anything, is this fixed on https://bodhi.fedoraproject.org/ ?

[leigh123linux]

@morxa

I get permission denied if I try to use them on other users packages now.

[morxa]

OK, same for me, I get permission denied. I just expected the button to be shown only if I have permissions to do the action.

[ralphbean]

Hey team! The API service did in fact get fixed to deny people without rights in #292.

We do still need to update the template logic to not show the buttons if you don't have rights. I just filed that as a separate issue in #321, if you want to track it.