From b765836cfd8bffc065ed45431c47926a91304947 Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Thu, 23 Mar 2017 12:41:56 -0400 Subject: [PATCH] Make sure blobs in CNR are auth checked --- endpoints/appr/registry.py | 4 ++++ endpoints/appr/test/test_api.py | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/endpoints/appr/registry.py b/endpoints/appr/registry.py index 2a6c08d60..d09b3a823 100644 --- a/endpoints/appr/registry.py +++ b/endpoints/appr/registry.py @@ -65,6 +65,9 @@ def login(): methods=['GET'], strict_slashes=False, ) +@process_auth +@require_app_repo_read +@anon_protect def blobs(namespace, package_name, digest): reponame = repo_name(namespace, package_name) data = cnr_registry.pull_blob(reponame, digest, blob_class=Blob) @@ -113,6 +116,7 @@ def delete_package(namespace, package_name, release, media_type): ) @process_auth @require_app_repo_read +@anon_protect def show_package(namespace, package_name, release, media_type): reponame = repo_name(namespace, package_name) result = cnr_registry.show_package(reponame, release, diff --git a/endpoints/appr/test/test_api.py b/endpoints/appr/test/test_api.py index a96ec1569..74311d09f 100644 --- a/endpoints/appr/test/test_api.py +++ b/endpoints/appr/test/test_api.py @@ -174,6 +174,10 @@ class TestServerQuayDB(BaseTestServer): def test_delete_channel_release_absent_release(self, db_with_data1, client): BaseTestServer.test_delete_channel_release_absent_release(self, db_with_data1, client) + @pytest.mark.xfail + def test_get_absent_blob(self, newdb, client): + pass + class TestQuayModels(CnrTestModels): DB_CLASS = QuayDB