Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Modify's add/remove_content_units is not validated for cross-domain content #5934

Closed
gerrod3 opened this issue Oct 24, 2024 · 0 comments · Fixed by #5935
Closed

Modify's add/remove_content_units is not validated for cross-domain content #5934

gerrod3 opened this issue Oct 24, 2024 · 0 comments · Fixed by #5935
Labels
Issue Triage-Needed

Comments

@gerrod3
Copy link
Contributor

gerrod3 commented Oct 24, 2024

Version
<=pulpcore 3.66

Describe the bug
You can add content from another domain using the modify endpoint.

To Reproduce
Have content in one domain, then in a separate domain issue a repo modify command with content from the first domain.

Expected behavior
The request should be denied, 400.
gerrod3 added a commit to gerrod3/pulpcore that referenced this issue Oct 24, 2024
@gerrod3
Ensure users can not add cross-domain content through modify endpoint
eb48cf2 
fixes: pulp#5934
@gerrod3 gerrod3 mentioned this issue Oct 24, 2024
Merged
gerrod3 added a commit to gerrod3/pulpcore that referenced this issue Oct 25, 2024
@gerrod3
Ensure users can not add cross-domain content through modify endpoint
f953f61 
fixes: pulp#5934
patchback bot pushed a commit that referenced this issue Oct 29, 2024
@gerrod3 @patchback
Ensure users can not add cross-domain content through modify endpoint
98c2c75 
fixes: #5934
(cherry picked from commit b898e2e)
@patchback patchback bot mentioned this issue Oct 29, 2024
Merged
patchback bot pushed a commit that referenced this issue Oct 29, 2024
@gerrod3 @patchback
Ensure users can not add cross-domain content through modify endpoint
cde80aa 
fixes: #5934
(cherry picked from commit b898e2e)
@patchback patchback bot mentioned this issue Oct 29, 2024
Merged
patchback bot pushed a commit that referenced this issue Oct 29, 2024
@gerrod3 @patchback
Ensure users can not add cross-domain content through modify endpoint
c81597e 
fixes: #5934
(cherry picked from commit b898e2e)
@patchback patchback bot mentioned this issue Oct 29, 2024
Merged
mdellweg pushed a commit that referenced this issue Oct 30, 2024
@gerrod3 @mdellweg
Ensure users can not add cross-domain content through modify endpoint
af344b4 
fixes: #5934
(cherry picked from commit b898e2e)
mdellweg pushed a commit that referenced this issue Oct 30, 2024
@gerrod3 @mdellweg
Ensure users can not add cross-domain content through modify endpoint
2e73975 
fixes: #5934
(cherry picked from commit b898e2e)
mdellweg pushed a commit that referenced this issue Oct 30, 2024
@gerrod3 @mdellweg
Ensure users can not add cross-domain content through modify endpoint
1df98c7 
fixes: #5934
(cherry picked from commit b898e2e)
@ggainey ggainey mentioned this issue Nov 7, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Issue Triage-Needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Ensure users can not add cross-domain content through modify endpoint gerrod3/pulpcore
1 participant
@gerrod3