Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SECURITY: prevent DeleteFilePost doing arbitrary deletion #5631

Merged
merged 1 commit into from Jan 4, 2019

Conversation

zeripath
Copy link
Contributor

@zeripath zeripath commented Jan 4, 2019

Unfortunately a suitably malformed request to DeleteFilePost will allow arbitrary deletion. Further it was also possible to adjust the .git directories on editFilePost and UploadFilePost.

@codecov-io
Copy link

codecov-io commented Jan 4, 2019

Codecov Report

No coverage uploaded for pull request base (master@5a1ea37). Click here to learn what that means.
The diff coverage is 6.25%.

Impacted file tree graph

@@            Coverage Diff            @@
##             master    #5631   +/-   ##
=========================================
  Coverage          ?   37.81%           
=========================================
  Files             ?      322           
  Lines             ?    47485           
  Branches          ?        0           
=========================================
  Hits              ?    17957           
  Misses            ?    26939           
  Partials          ?     2589
Impacted Files Coverage Δ
routers/repo/editor.go 29.01% <6.25%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5a1ea37...d87fcfc. Read the comment docs.

@jonasfranz
Copy link
Member

@go-gitea/owners I think we have to backport this to 1.6 since this is quite critical IMHO.

routers/repo/editor.go Show resolved Hide resolved
    This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>
@techknowlogick techknowlogick merged commit fd1e856 into go-gitea:master Jan 4, 2019
@techknowlogick
Copy link
Member

@zeripath thanks for PR :) as @jonasfranz has said, please backport to both release/v1.7 and release/v1.6

@zeripath zeripath deleted the protect-delete-file branch January 4, 2019 16:13
zeripath added a commit to zeripath/gitea that referenced this pull request Jan 4, 2019
…itea#5631)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>
zeripath added a commit to zeripath/gitea that referenced this pull request Jan 4, 2019
…itea#5631)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>
jonasfranz pushed a commit that referenced this pull request Jan 4, 2019
… (#5634)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>
jonasfranz pushed a commit that referenced this pull request Jan 4, 2019
… (#5635)

This commit wraps more of the TreePaths with cleanUploadFileName

Signed-off-by: Andrew Thornton <art27@cantab.net>
@lafriks lafriks modified the milestones: 1.7.0, 1.8.0 Jan 4, 2019
@go-gitea go-gitea locked and limited conversation to collaborators Nov 24, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Development

Successfully merging this pull request may close these issues.

None yet

6 participants