Attachment 301334 Details for Bug 440989 – added authorization to default CMC enrollment profile. Added error output.

added authorization to default CMC enrollment profile. Added error output.

bug440989.fix (text/plain), 2.57 KB, created by Christina Fu on 2008-04-04 20:41:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Christina Fu

Created: 2008-04-04 20:41:14 UTC

Size: 2.57 KB

patch

obsolete

>Index: linux/common/pki-common.spec
>===================================================================
>--- linux/common/pki-common.spec	(revision 16)
>+++ linux/common/pki-common.spec	(working copy)
>@@ -33,7 +33,7 @@
> ## Package Header Definitions
> %define base_name         %{base_prefix}-%{base_component}
> %define base_version      1.0.0
>-%define base_release      2
>+%define base_release      3
> %define base_group        System Environment/Base
> %define base_vendor       Red Hat, Inc.
> %define base_license      GPLv2 with exceptions
>@@ -294,6 +294,8 @@
> ###############################################################################
> 
> %changelog
>+* Fri Apr 4 2008 Christina Fu <cfu@redhat.com> 1.0.0-3
>+- Fixed bug #40989 - [SECURITY] CMC authorization check not done by default
> * Fri Apr 4 2008 Christina Fu <cfu@redhat.com> 1.0.0-2
> - Fixed bug #439052 - CMC CRMF requests cause exception in logging: Unmatched braces in the pattern
> * Tue Feb 19 2008 PKI Team <pki-devel@redhat.com> 1.0.0-1
>Index: base/ca/shared/profiles/ca/caCMCUserCert.cfg
>===================================================================
>--- base/ca/shared/profiles/ca/caCMCUserCert.cfg	(revision 16)
>+++ base/ca/shared/profiles/ca/caCMCUserCert.cfg	(working copy)
>@@ -3,6 +3,7 @@
> enable=true
> enableBy=admin
> auth.instance_id=CMCAuth
>+authz.acl=group="Certificate Manager Agents"
> name=Signed CMC-Authenticated User Certificate Enrollment
> input.list=i1,i2
> input.i1.class_id=cmcCertReqInputImpl
>Index: base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java
>===================================================================
>--- base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java	(revision 16)
>+++ base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java	(working copy)
>@@ -415,9 +415,16 @@
>                     AuthzToken authzToken = authorize(mAclMethod, authToken, acl);
>                 } catch (Exception e) {
>                     CMS.debug("ProfileSubmitServlet authorize: "+e.toString());
>-                    if (xmlOutput)
>+                    if (xmlOutput) {
>                         outputError(response, CMS.getUserMessage(locale, 
>                           "CMS_AUTHORIZATION_ERROR"));
>+                    } else {
>+                        args.set(ARG_ERROR_CODE, "1");
>+                        args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
>+                            "CMS_AUTHORIZATION_ERROR"));
>+                        outputTemplate(request, response, args);
>+                    }
>+
>                     return;
>                 }
>             }

Actions: View

Attachments on bug 440989: 301334