Repository navigation
Fixes #40026 - Authorize template revision lookups - #11377
Merged
Merged
Conversation
adamruzicka
force-pushed
the
cve/2026-81658
branch
2 times, most recently
from
November 11, 2026 14:06
262261b to
3950924
Compare
ofedoren
previously approved these changes
Nov 11, 2026
ofedoren
left a comment
ofedoren
left a comment
Member
There was a problem hiding this comment.
Thanks, @adamruzicka ! Automated review found few places for improvement, but those are mostly nits, so I'd leave it as is and won't complicate it even more.
Rubocop is red though and I guess we can squash it so it's mergable.
Contributor
Author
|
Rubocop is red on azure being down :/ |
adamruzicka
force-pushed
the
cve/2026-81658
branch
from
November 11, 2026 15:37
3950924 to
8fbba53
Compare
CVE-2026-81658 Enforce audit visibility on revisions and history Introduce Audit.visible, which applies taxonomy scoping before permission filters so taxed_and_untaxed no longer discards audit search restrictions in the audits controllers. Use it for template revision lookups (provisioning templates, ptables, report templates, both UI and API), returning not_found when the audit is not visible, and hide the template History tab from users without view_audit_logs permission. Secure the previous_revision rendering macro: it now reads revisions through Audit.visible, so safe mode reports need view_audit_logs access to each audit and cannot read history from another tenant. Deduplicate the revision authorization tests into a shared concern. Co-authored-by: Oleh Fedorenko <ofedoren@redhat.com>
adamruzicka
force-pushed
the
cve/2026-81658
branch
from
November 12, 2026 15:09
8fbba53 to
8e5519b
Compare
ofedoren
approved these changes
Nov 12, 2026
ofedoren
left a comment
ofedoren
left a comment
Member
There was a problem hiding this comment.
Thanks, @adamruzicka ! I have nothing to add anymore.
It's unfortunate though this PR got that big :/ Hopefully we will be able to CP this cleanly...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-81658