vriska/hydra
0
0
Fork 0
forked from lix-project/hydra
Code Pull requests Activity

Allow only project owners to delete projects / jobsets

Browse source 
Giant gaping security hole.
This commit is contained in:
Eelco Dolstra 2013-10-03 13:06:16 +02:00
parent 7a5ec00ea1
commit 9f3b47c963
2 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/lib/Hydra/Controller/Jobset.pm
View file

@ -219,6 +219,7 @@ sub submit : Chained('jobsetChain') PathPart Args(0) {
my ($self, $c) = @_; my ($self, $c) = @_;
requirePost($c); requirePost($c);
requireProjectOwner($c, $c->stash->{project});
if (($c->request->params->{submit} // "") eq "delete") { if (($c->request->params->{submit} // "") eq "delete") {
txn_do($c->model('DB')->schema, sub { txn_do($c->model('DB')->schema, sub {

2
src/lib/Hydra/Controller/Project.pm
View file

@ -143,6 +143,8 @@ sub submit : Chained('projectChain') PathPart Args(0) {
my ($self, $c) = @_; my ($self, $c) = @_;
requirePost($c); requirePost($c);
requireProjectOwner($c, $c->stash->{project});
if (($c->request->params->{submit} // "") eq "delete") { if (($c->request->params->{submit} // "") eq "delete") {
txn_do($c->model('DB')->schema, sub { txn_do($c->model('DB')->schema, sub {
$c->stash->{project}->jobsetevals->delete_all; $c->stash->{project}->jobsetevals->delete_all;