aleksis/AlekSIS-Core
9
0
Fork 0
Code Issues 197 Pull requests 63 Projects Releases 14 Packages 1 Wiki Activity Actions

Resolve "ClientProtectedResourceMixin allows access if no allowed_scopes are set" #2656

Merged
hansegucker merged 4 commits from 688-clientprotectedresourcemixin-allows-access-if-no-allowed_scopes-are-set into master 2022-05-04 00:53:00 +02:00
Conversation 15 Commits 4 Files changed 4 +95 -1
hansegucker commented 2022-04-19 20:22:59 +02:00
Owner
Copy link

Closes #688

Closes #688
hansegucker commented 2022-04-23 19:58:27 +02:00
Author
Owner
Copy link

added 1 commit

  • a152704a - Reject access if there are no allowed_scopes set (ClientProtectedResourceMixin)

Compare with previous version

added 1 commit <ul><li>a152704a - Reject access if there are no allowed_scopes set (ClientProtectedResourceMixin)</li></ul> [Compare with previous version](/AlekSIS/official/AlekSIS-Core/-/merge_requests/1011/diffs?diff_id=20649&start_sha=14262ec4fe0aea9d3f5440a434281c3d15bf9975)
hansegucker commented 2022-04-23 19:58:28 +02:00
Author
Owner
Copy link

assigned to @nik

assigned to @nik
hansegucker commented 2022-04-23 19:58:29 +02:00
Author
Owner
Copy link

marked this merge request as ready

marked this merge request as **ready**
hansegucker commented 2022-04-23 20:41:08 +02:00
Author
Owner
Copy link

added 45m of time spent

added 45m of time spent
nik commented 2022-04-25 21:41:51 +02:00
Owner
Copy link
  allowed access if no scopes were allowed.
```suggestion:-0+0 allowed access if no scopes were allowed. ```
nik commented 2022-04-25 21:42:04 +02:00
Owner
Copy link

This needs a regression test.

This needs a regression test.
hansegucker commented 2022-04-26 19:37:09 +02:00
Author
Owner
Copy link

added 1 commit

  • acf03a29 - Add regression test for broken ClientProtectedResourceMixin

Compare with previous version

added 1 commit <ul><li>acf03a29 - Add regression test for broken ClientProtectedResourceMixin</li></ul> [Compare with previous version](/AlekSIS/official/AlekSIS-Core/-/merge_requests/1011/diffs?diff_id=20717&start_sha=a152704ac08abf18e2e1e0bb531b100728e5cae2)
nik commented 2022-04-26 19:44:31 +02:00
Owner
Copy link

This needs to be backported to 2.7

This needs to be backported to 2.7
nik commented 2022-04-28 10:49:58 +02:00
Owner
Copy link

Is there any good reason we are holding back this security fix, @hansegucker? What stops you from applying this suggestion?

Is there any good reason we are holding back this security fix, @hansegucker? What stops you from applying this suggestion?
hansegucker commented 2022-04-28 17:08:00 +02:00
Author
Owner
Copy link

Not being on my laptop stopped me until now.

Not being on my laptop stopped me until now.
hansegucker commented 2022-04-28 17:08:01 +02:00
Author
Owner
Copy link

resolved all threads

resolved all threads
hansegucker commented 2022-04-28 17:08:14 +02:00
Author
Owner
Copy link

changed this line in version 3 of the diff

changed this line in [version 3 of the diff](/AlekSIS/official/AlekSIS-Core/-/merge_requests/1011/diffs?diff_id=20746&start_sha=acf03a29f1bc58820dbf5f62ed49255db81ca225#45267e3a9556cafa9cb7b61dab7a3b6659e73aad_30_30)
hansegucker commented 2022-04-28 17:08:15 +02:00
Author
Owner
Copy link

added 1 commit

Compare with previous version

added 1 commit <ul><li>02669dca - Fix wording in changelog</li></ul> [Compare with previous version](/AlekSIS/official/AlekSIS-Core/-/merge_requests/1011/diffs?diff_id=20746&start_sha=acf03a29f1bc58820dbf5f62ed49255db81ca225)
nik commented 2022-05-03 23:58:43 +02:00
Owner
Copy link

added 10 commits

  • 02669dca...edb64b64 - 9 commits from branch master
  • 480cf497 - Merge branch 'master' into...

Compare with previous version

added 10 commits <ul><li>02669dca...edb64b64 - 9 commits from branch <code>master</code></li><li>480cf497 - Merge branch &#39;master&#39; into...</li></ul> [Compare with previous version](/AlekSIS/official/AlekSIS-Core/-/merge_requests/1011/diffs?diff_id=20889&start_sha=02669dca10341507782044971d3d7e7d5a984ca2)
nik scheduled this pull request to auto merge when all checks succeed 2022-05-03 23:58:53 +02:00
nik merged commit 0d39d5f566 into master 2022-05-04 00:53:00 +02:00
nik commented 2022-05-04 00:53:02 +02:00
Owner
Copy link

mentioned in commit 0d39d5f566

mentioned in commit 0d39d5f566e1d916e3c8dedd3f5bd62161f30bd8
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
Security

   
TeX
Needs LaTeX template

  
auto-update
  
board
done

  
board
ready

  
board
todo

  
check
delete-eslint-rc-js

  
check
update-builddeps-package-json

  
check
update-eslint-rc-js

  
check
update-gitignore

  
check
update-merge-request-template

  
check
update-prettier-ignore

  
check
update-pyproject-toml

  
check
update-renovate-json

  
check
update-tox-ini

  
part
backend
 Backend (view code, models, logic, etc.)

  
part
ci

  
part
docs
 Issue or addition to the documentation

  
part
frontend
 Frontend (templates, etc.)

  
part
i18n
 Translation or internationalisation issue

  
part
non-technical
 Non-technical (policy, maintenance, etc.) issue or discussion

  
part
packaging
 Issue concerning the packaging of AlekSIS and components

  
prio
1
 Priority High

  
prio
2
 Priority Medium

  
prio
3
 Priority Low

  
release-mr-5.x
  
size
large

  
size
medium

  
size
small

  
source
customer
 Requested by a customer or affiliated user

  
source
customer::fsmw

  
source
customer::fss

  
source
customer::teckids

  
source
downstream
 Issue or merge request from other projects using AlekSIS or parts of it

  
type
breaking

  
type
bug
 Bug

  
type
feature
 New feature

  
type
refactoring

  
workflow
blocked
 Issue is blocked by another issue

  
workflow
confirmed
 The bug is reproducible and will be fixed

  
workflow
current-todo

  
workflow
discussing
 Needs to be discussed before implementation

  
workflow
new-app
 Requires new AlekSIS app, which has to be created

  
workflow
wontfix
 The bug is not reproducible or the feature was decided against

No labels
Security
TeX
auto-update
board
done
board
ready
board
todo
check
delete-eslint-rc-js
check
update-builddeps-package-json
check
update-eslint-rc-js
check
update-gitignore
check
update-merge-request-template
check
update-prettier-ignore
check
update-pyproject-toml
check
update-renovate-json
check
update-tox-ini
part
backend
part
ci
part
docs
part
frontend
part
i18n
part
non-technical
part
packaging
prio
1
prio
2
prio
3
release-mr-5.x
size
large
size
medium
size
small
source
customer
source
customer::fsmw
source
customer::fss
source
customer::teckids
source
downstream
type
breaking
type
bug
type
feature
type
refactoring
workflow
blocked
workflow
confirmed
workflow
current-todo
workflow
discussing
workflow
new-app
workflow
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
nik
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aleksis/AlekSIS-Core!2656
No description provided.