Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix read/pull permission checks #1897

Closed
wants to merge 2 commits into from
Closed

Conversation

pfeuffer
Copy link
Member

Proposed changes

Users with repository:read permission can only read the metadata of a repository, no source code or otherwise repository related data like branches or tags.

Fixes #1895

Your checklist for this pull request

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

Contributor:

  • PR is well described and the description can be used as a commit message on squash
  • Related issues linked to PR if existing and labels set
  • New code is covered with unit tests
  • Changelog entry file created in gradle/changelog or CHANGELOG.md is updated for plugins
  • Feature has been tested with different permissions
  • Documentation updated (only necessary for new features or changed behaviour)

Reviewer:

  • The clean code principles are respected (CleanCode)
  • All new code/logic is implemented on the right spot / "Should this be done here?"
  • UI changes fits into the layout
  • The UI views / components are responsive (mobile views)
  • Correct translations are available

Checklist for branch merge request (not required for forks)

@sonarcloud
Copy link

sonarcloud bot commented Dec 15, 2021

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

67.9% 67.9% Coverage
0.0% 0.0% Duplication

@pfeuffer pfeuffer marked this pull request as ready for review December 15, 2021 16:08
@sdorra
Copy link
Member

sdorra commented Dec 16, 2021

@pfeuffer I'm not sure if it is the right way to check the permission on the resource level. It is too easy to make the same mistake again. I think it is better to check the permission on the service level. Perhaps on get methods for the commands?

@pfeuffer
Copy link
Member Author

@pfeuffer I'm not sure if it is the right way to check the permission on the resource level. It is too easy to make the same mistake again. I think it is better to check the permission on the service level. Perhaps on get methods for the commands?

Me neither. I used this way, because we already had checks here.

@pfeuffer pfeuffer closed this Dec 16, 2021
@pfeuffer pfeuffer deleted the bugfix/read_permission branch December 16, 2021 07:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

"List" permission
2 participants