Attachment 618256 Details for Bug 861179 – CVE-2012-4456-keystone-1006815.patch

[patch] CVE-2012-4456-keystone-1006815.patch

CVE-2012-4456-keystone-1006815.patch (text/plain), 1.68 KB, created by Kurt Seifried on 2012-09-27 19:20:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2012-09-27 19:20:58 UTC

Size: 1.68 KB

patch

obsolete

>commit 14b136aed9d988f5a8f3e699bd4577c9b874d6c1
>Author: Dolph Mathews <dolph.mathews@gmail.com>
>Date:   Sun Jun 3 12:24:07 2012 -0500
>
>    Require authz for user role list (bug 1006815)
>    
>    Change-Id: I65f25dcca3e265f44746930917434b45e64de15e
>
>diff --git a/keystone/identity/core.py b/keystone/identity/core.py
>index 83b1798..a0704f1 100644
>--- a/keystone/identity/core.py
>+++ b/keystone/identity/core.py
>@@ -457,6 +457,7 @@ class RoleController(wsgi.Application):
>         not implementing them in hopes that the idea will die off.
> 
>         """
>+        self.assert_admin(context)
>         if tenant_id is None:
>             raise exception.NotImplemented(message='User roles not supported: '
>                                                    'tenant ID required')
>diff --git a/tests/test_content_types.py b/tests/test_content_types.py
>index df73dff..4955084 100644
>--- a/tests/test_content_types.py
>+++ b/tests/test_content_types.py
>@@ -587,6 +587,17 @@ class JsonTestCase(RestfulTestCase, CoreApiTests):
>                                expected_status=401)
>         self.assertValidErrorResponse(r)
> 
>+    def test_user_role_list_requires_auth(self):
>+        """User role list should 401 without an X-Auth-Token (bug 1006815)."""
>+        # values here don't matter because we should 401 before they're checked
>+        path = '/v2.0/tenants/%(tenant_id)s/users/%(user_id)s/roles' % {
>+                'tenant_id': uuid.uuid4().hex,
>+                'user_id': uuid.uuid4().hex,
>+        }
>+
>+        r = self.admin_request(path=path, expected_status=401)
>+        self.assertValidErrorResponse(r)
>+
> 
> class XmlTestCase(RestfulTestCase, CoreApiTests):
>     xmlns = 'http://docs.openstack.org/identity/api/v2.0'

Actions: View | Diff

Attachments on bug 861179: 618256 | 618257