Repository navigation
Develop v2.1.0 #1938
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Develop v2.1.0 #1938
Changes from all commits
8c6e47c
c815582
1b30bf5
ea59fc2
4be9e0a
b2ae6cc
975737f
fcdfcbb
8e48e4b
99baeec
6743f9a
3af98d0
e97bad6
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| # | ||
| # This file is part of Invenio. | ||
| # Copyright (C) 2016-2018 CERN. | ||
| # | ||
| # Invenio is free software; you can redistribute it and/or modify it | ||
| # under the terms of the MIT License; see LICENSE file for more details. | ||
|
|
||
| """add column file readonly_keys""" | ||
|
|
||
| from alembic import op | ||
| import sqlalchemy as sa | ||
|
|
||
|
|
||
| # revision identifiers, used by Alembic. | ||
| revision = 'faf4faa08601' | ||
| down_revision = '8644b32a3eec' | ||
| branch_labels = () | ||
| depends_on = None | ||
|
|
||
|
|
||
| def upgrade(): | ||
| """Upgrade database.""" | ||
| op.add_column('files_location', sa.Column('readonly_access_key', sa.String(length=128), nullable=True)) | ||
| op.add_column('files_location', sa.Column('readonly_secret_key', sa.String(length=128), nullable=True)) | ||
|
|
||
|
|
||
| def downgrade(): | ||
| """Downgrade database.""" | ||
| op.drop_column('files_location', 'readonly_secret_key') | ||
| op.drop_column('files_location', 'readonly_access_key') | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -611,12 +611,13 @@ def upload_file(community_id): | |
| @blueprint.route('/widget/uploaded/<string:filename>/<string:community_id>', | ||
| methods=["GET"] | ||
| ) | ||
| @roles_required([WEKO_ADMIN_PERMISSION_ROLE_SYSTEM, | ||
| WEKO_ADMIN_PERMISSION_ROLE_REPO, | ||
| WEKO_ADMIN_PERMISSION_ROLE_COMMUNITY]) | ||
|
Comment on lines
-614
to
-616
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 High · Private widget files are exposed When a private or unpublished widget file exists and an unauthenticated caller knows or guesses its filename and community ID, Restore checks for community visibility and caller authorization before serving a widget file. Prompt for AI agentsIn `modules/weko-gridlayout/weko_gridlayout/views.py` at lines 614-616:
**Private widget files are exposed**
When a private or unpublished widget file exists and an unauthenticated caller knows or guesses its filename and community ID, `uploaded_file()` passes the request to `WidgetBucket.get_file()` without checking community visibility or caller access, so the caller retrieves the private file without logging in.
Restore checks for community visibility and caller authorization before serving a widget file. |
||
| def uploaded_file(filename, community_id=0): | ||
| """Get widget static file. | ||
|
|
||
| The files are embedded in widgets (e.g. images in a free description | ||
| widget) and are loaded by the browser on the public pages, so this view | ||
| must be reachable without logging in. | ||
|
|
||
| :param filename: file name. | ||
| :param community_id: community identifier. | ||
| :return: | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 Critical · Database upgrades cannot load
When alembic loads the registered migration graph for an upgrade or downgrade, alembic cannot resolve
down_revision8644b32a3eecbecause no migration with that revision exists, so the migration graph fails to load and database upgrades cannot run.Set
down_revisionto the actual existing parent revision for this migration.Prompt for AI agents