vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Make sure to add primary repo permissions under a transaction

Browse source 
Should prevent a repository from being created under a user's namespace without a corresponding admin permission

Fixes https://jira.coreos.com/browse/QUAY-826
This commit is contained in:
Joseph Schorr 2018-02-06 11:20:40 -05:00
parent 00ae24cb2f
commit da0fa2e0d2
1 changed files with 14 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
data/model/repository.py
View file

@ -38,6 +38,7 @@ def create_repository(namespace, name, creating_user, visibility='private', repo
namespace_user = User.get(username=namespace) namespace_user = User.get(username=namespace)
yesterday = datetime.now() - timedelta(days=1) yesterday = datetime.now() - timedelta(days=1)
with db_transaction():
repo = Repository.create(name=name, visibility=Repository.visibility.get_id(visibility), repo = Repository.create(name=name, visibility=Repository.visibility.get_id(visibility),
namespace_user=namespace_user, namespace_user=namespace_user,
kind=Repository.kind.get_id(repo_kind), kind=Repository.kind.get_id(repo_kind),
@ -46,12 +47,13 @@ def create_repository(namespace, name, creating_user, visibility='private', repo
RepositoryActionCount.create(repository=repo, count=0, date=yesterday) RepositoryActionCount.create(repository=repo, count=0, date=yesterday)
RepositorySearchScore.create(repository=repo, score=0) RepositorySearchScore.create(repository=repo, score=0)
# Note: We put the admin create permission under the transaction to ensure it is created.
if creating_user and not creating_user.organization: if creating_user and not creating_user.organization:
admin = Role.get(name='admin') admin = Role.get(name='admin')
RepositoryPermission.create(user=creating_user, repository=repo, role=admin) RepositoryPermission.create(user=creating_user, repository=repo, role=admin)
if creating_user.username != namespace: # Apply default permissions (only occurs for repositories under organizations)
# Permission prototypes only work for orgs if creating_user and not creating_user.organization and creating_user.username != namespace:
permission.apply_default_permissions(repo, creating_user) permission.apply_default_permissions(repo, creating_user)
return repo return repo