[copr] master: Use explicit enumeration for serialialized user attributes to prevent possible exposure of credentials (3dc860e)
bkabrda at fedoraproject.org
bkabrda at fedoraproject.org
Tue Jan 8 12:34:27 UTC 2013
Repository : http://git.fedorahosted.org/cgit/copr.git
On branch : master
>---------------------------------------------------------------
commit 3dc860ed701a363d872f1f2d2504b095d73dc2bf
Author: Bohuslav Kabrda <bkabrda at redhat.com>
Date: Tue Jan 8 13:33:33 2013 +0100
Use explicit enumeration for serialialized user attributes to prevent possible exposure of credentials
>---------------------------------------------------------------
coprs_frontend/coprs/models.py | 3 ++-
.../coprs/views/backend_ns/backend_general.py | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/coprs_frontend/coprs/models.py b/coprs_frontend/coprs/models.py
index c7120a1..cf1397e 100644
--- a/coprs_frontend/coprs/models.py
+++ b/coprs_frontend/coprs/models.py
@@ -95,7 +95,8 @@ class User(db.Model, Serializer):
@property
def serializable_attributes(self):
- return super(User, self).serializable_attributes + ['name']
+ # enumerate here to prevent exposing credentials
+ return ['id', 'name']
class Copr(db.Model, Serializer):
diff --git a/coprs_frontend/coprs/views/backend_ns/backend_general.py b/coprs_frontend/coprs/views/backend_ns/backend_general.py
index 1c15595..c315cde 100644
--- a/coprs_frontend/coprs/views/backend_ns/backend_general.py
+++ b/coprs_frontend/coprs/views/backend_ns/backend_general.py
@@ -13,7 +13,7 @@ def waiting_builds():
query = builds_logic.BuildsLogic.get_waiting_builds(None)
builds = query[0:10]
- return flask.jsonify({'builds': [build.to_dict(options = {'copr': {'owner': {'__columns_except__': ['openid_name', 'proven', 'admin', 'mail'] },
+ return flask.jsonify({'builds': [build.to_dict(options = {'copr': {'owner': {},
'__columns_except__': ['chroots', 'repos', 'build_count'],
'__included_ids__': False},
'__included_ids__': False}) for build in builds]})
More information about the copr-devel
mailing list