vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Prevent registry operations against disabled namespaces

Browse source 
Allows admins to completely wall off a namespace by disabling it

Fixes https://jira.coreos.com/browse/QUAY-869
This commit is contained in:
Joseph Schorr 2018-05-22 18:36:04 -04:00
parent 6ffafe44d3
commit f86c087b3b
14 changed files with 102 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
endpoints/v2/v2auth.py
View file

@ -13,7 +13,8 @@ from auth.permissions import (ModifyRepositoryPermission, ReadRepositoryPermissi
CreateRepositoryPermission, AdministerRepositoryPermission)
from endpoints.decorators import anon_protect
from endpoints.v2 import v2_bp
from endpoints.v2.errors import InvalidLogin, NameInvalid, InvalidRequest, Unsupported, Unauthorized
from endpoints.v2.errors import (InvalidLogin, NameInvalid, InvalidRequest, Unsupported,
Unauthorized, NamespaceDisabled)
from endpoints.v2.models_pre_oci import data_model as model
from util.cache import no_cache
from util.names import parse_namespace_repository, REPOSITORY_NAME_REGEX
@ -160,6 +161,11 @@ def _authorize_or_downscope_request(scope_param, has_valid_auth_context):
raise NameInvalid(message='Invalid repository name: %s' % namespace_and_repo)
# Ensure the namespace is enabled.
if not model.is_namespace_enabled(namespace):
msg = 'Namespace %s has been disabled. Please contact a system administrator.' % namespace
raise NamespaceDisabled(message=msg)
final_actions = []
repo = model.get_repository(namespace, reponame)