From 1988b916ec8b500d35b200114373e1cab7951b5b Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Tue, 5 Jan 2021 13:44:18 -0500 Subject: [PATCH 1/5] Adds a 410 response to PATCH /Instance --- .../Controllers/InstanceController.cs | 17 ++++++++++++++--- .../InstanceManagerTest.cs | 5 +++++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/src/Tgstation.Server.Host/Controllers/InstanceController.cs b/src/Tgstation.Server.Host/Controllers/InstanceController.cs index 07d57d2aee..85f88e14ed 100644 --- a/src/Tgstation.Server.Host/Controllers/InstanceController.cs +++ b/src/Tgstation.Server.Host/Controllers/InstanceController.cs @@ -730,19 +730,30 @@ namespace Tgstation.Server.Host.Controllers [HttpPatch("{id}")] [TgsAuthorize(InstanceManagerRights.GrantPermissions)] [ProducesResponseType(204)] + [ProducesResponseType(typeof(ErrorMessage), 410)] public async Task GrantPermissions(long id, CancellationToken cancellationToken) { - // ensure the current user has write privilege on the instance - var usersInstancePermissionSet = await DatabaseContext + IQueryable BaseQuery() => DatabaseContext .Instances .AsQueryable() - .Where(x => x.Id == id && x.SwarmIdentifer == swarmConfiguration.Identifier) + .Where(x => x.Id == id && x.SwarmIdentifer == swarmConfiguration.Identifier); + + // ensure the current user has write privilege on the instance + var usersInstancePermissionSet = await BaseQuery() .SelectMany(x => x.InstancePermissionSets) .Where(x => x.PermissionSetId == AuthenticationContext.PermissionSet.Id.Value) .FirstOrDefaultAsync(cancellationToken) .ConfigureAwait(false); if (usersInstancePermissionSet == default) { + // does the instance actually exist? + var instanceExists = await BaseQuery() + .AnyAsync(cancellationToken) + .ConfigureAwait(false); + + if (!instanceExists) + return Gone(); + var instanceAdminUser = InstanceAdminPermissionSet(null); instanceAdminUser.InstanceId = id; DatabaseContext.InstancePermissionSets.Add(instanceAdminUser); diff --git a/tests/Tgstation.Server.Tests/InstanceManagerTest.cs b/tests/Tgstation.Server.Tests/InstanceManagerTest.cs index 4d58695cdf..495b086304 100644 --- a/tests/Tgstation.Server.Tests/InstanceManagerTest.cs +++ b/tests/Tgstation.Server.Tests/InstanceManagerTest.cs @@ -89,6 +89,11 @@ namespace Tgstation.Server.Tests Path = testNonEmpty }, cancellationToken), ErrorCode.InstanceAtExistingPath).ConfigureAwait(false); + await ApiAssert.ThrowsException(() => instanceManagerClient.GrantPermissions(new Api.Models.Instance + { + Id = 3482974, + }, cancellationToken), ErrorCode.ResourceNotPresent).ConfigureAwait(false); + // test can't create instance outside of whitelist await ApiAssert.ThrowsException(() => instanceManagerClient.CreateOrAttach(new Api.Models.Instance { From acd6d4c81f0101a76c6e44134b2aefb7e103037e Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Tue, 5 Jan 2021 13:44:53 -0500 Subject: [PATCH 2/5] API and TGS version bump --- build/Version.props | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build/Version.props b/build/Version.props index ec3c9db431..44647f7611 100644 --- a/build/Version.props +++ b/build/Version.props @@ -3,9 +3,9 @@ - 4.7.2 + 4.7.3 2.2.0 - 8.1.2 + 8.2.0 9.1.1 5.2.10 1.1.0 From 944c5dd3862df8ba7637a2cf8eb15fdcbc4bfcf4 Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Tue, 5 Jan 2021 16:30:59 -0500 Subject: [PATCH 3/5] Do not browser redirect / if headers are present --- .../Controllers/HomeController.cs | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/Tgstation.Server.Host/Controllers/HomeController.cs b/src/Tgstation.Server.Host/Controllers/HomeController.cs index e08e0cde15..1c74dc1b74 100644 --- a/src/Tgstation.Server.Host/Controllers/HomeController.cs +++ b/src/Tgstation.Server.Host/Controllers/HomeController.cs @@ -161,15 +161,16 @@ namespace Tgstation.Server.Host.Controllers #pragma warning disable CA1506 public async Task Home(CancellationToken cancellationToken) { - // if we are using a browser and the control panel, soft redirect to the app page - if (controlPanelConfiguration.Enable && browserResolver.Browser.Type != BrowserType.Generic) - { - Logger.LogDebug("Unauthorized browser request (User-Agent: \"{0}\"), redirecting to control panel...", browserResolver.UserAgent); - return Redirect(Core.Application.ControlPanelRoute); - } - // we only allow authorization header issues if (ApiHeaders == null) + { + // if we are using a browser and the control panel, soft redirect to the app page + if (controlPanelConfiguration.Enable && browserResolver.Browser.Type != BrowserType.Generic) + { + Logger.LogDebug("Unauthorized browser request (User-Agent: \"{0}\"), redirecting to control panel...", browserResolver.UserAgent); + return Redirect(Core.Application.ControlPanelRoute); + } + try { var headers = new ApiHeaders(Request.GetTypedHeaders(), true); @@ -182,6 +183,7 @@ namespace Tgstation.Server.Host.Controllers { return HeadersIssue(true); } + } return Json(new ServerInformation { From ef813cca609e12e27c052f3a65422cee61a705ec Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Tue, 5 Jan 2021 16:35:18 -0500 Subject: [PATCH 4/5] Add a Vary header on GET / --- .../Controllers/HomeController.cs | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/Tgstation.Server.Host/Controllers/HomeController.cs b/src/Tgstation.Server.Host/Controllers/HomeController.cs index 1c74dc1b74..4dcad917d2 100644 --- a/src/Tgstation.Server.Host/Controllers/HomeController.cs +++ b/src/Tgstation.Server.Host/Controllers/HomeController.cs @@ -158,13 +158,22 @@ namespace Tgstation.Server.Host.Controllers [HttpGet] [AllowAnonymous] [ProducesResponseType(typeof(ServerInformation), 200)] - #pragma warning disable CA1506 +#pragma warning disable CA1506 public async Task Home(CancellationToken cancellationToken) { + if (controlPanelConfiguration.Enable) + Response.Headers.Add( + HeaderNames.Vary, + new StringValues( + new[]{ + HeaderNames.UserAgent, + ApiHeaders.ApiVersionHeader + })); + // we only allow authorization header issues if (ApiHeaders == null) { - // if we are using a browser and the control panel, soft redirect to the app page + // if we are using a browser and the control panel, redirect to the app page if (controlPanelConfiguration.Enable && browserResolver.Browser.Type != BrowserType.Generic) { Logger.LogDebug("Unauthorized browser request (User-Agent: \"{0}\"), redirecting to control panel...", browserResolver.UserAgent); From 334bb47ed91e2216d43e222ed6897e3d9871798d Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Tue, 5 Jan 2021 17:52:36 -0500 Subject: [PATCH 5/5] Trim trailing .git from remote repository names --- .../Components/Repository/GitHubRemoteFeatures.cs | 2 ++ .../Components/Repository/GitLabRemoteFeatures.cs | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/Tgstation.Server.Host/Components/Repository/GitHubRemoteFeatures.cs b/src/Tgstation.Server.Host/Components/Repository/GitHubRemoteFeatures.cs index 260e64fa7e..9a068eb8c9 100644 --- a/src/Tgstation.Server.Host/Components/Repository/GitHubRemoteFeatures.cs +++ b/src/Tgstation.Server.Host/Components/Repository/GitHubRemoteFeatures.cs @@ -51,6 +51,8 @@ namespace Tgstation.Server.Host.Components.Repository RemoteRepositoryOwner = remoteUrl.Segments[1].TrimEnd('/'); RemoteRepositoryName = remoteUrl.Segments[2].TrimEnd('/'); + if (RemoteRepositoryName.EndsWith(".git", StringComparison.OrdinalIgnoreCase)) + RemoteRepositoryName = RemoteRepositoryName[0..^4]; } /// diff --git a/src/Tgstation.Server.Host/Components/Repository/GitLabRemoteFeatures.cs b/src/Tgstation.Server.Host/Components/Repository/GitLabRemoteFeatures.cs index cf5fd71149..c894f9aa84 100644 --- a/src/Tgstation.Server.Host/Components/Repository/GitLabRemoteFeatures.cs +++ b/src/Tgstation.Server.Host/Components/Repository/GitLabRemoteFeatures.cs @@ -45,6 +45,8 @@ namespace Tgstation.Server.Host.Components.Repository { RemoteRepositoryOwner = remoteUrl.Segments[1].TrimEnd('/'); RemoteRepositoryName = remoteUrl.Segments[2].TrimEnd('/'); + if (RemoteRepositoryName.EndsWith(".git", StringComparison.OrdinalIgnoreCase)) + RemoteRepositoryName = RemoteRepositoryName.Substring(0, RemoteRepositoryName.Length - 4); } ///