This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit 4fe4e280870d357be343d7d02139db0c9bb0fc16 Author: Dave Brondsema <[email protected]> AuthorDate: Tue May 5 17:21:27 2026 -0400 [#8603] only permit local access to /auth/repo_permissions --- Allura/allura/controllers/auth.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py index 6b7272d87..7aedac3da 100644 --- a/Allura/allura/controllers/auth.py +++ b/Allura/allura/controllers/auth.py @@ -23,6 +23,7 @@ from base64 import b32encode from datetime import datetime import re +import ipaddress from urllib.parse import urlparse, urljoin, urlunparse import bson @@ -564,6 +565,10 @@ def repo_permissions(self, repo_path=None, username=None, **kw): Returns JSON describing this user's permissions on that repo. """ + ip = ipaddress.ip_address(utils.ip_address(request)) + if not ip or not ip.is_private: + raise wexc.HTTPForbidden("Access to repo permissions is restricted to internal network connections") + disallow = dict(allow_read=False, allow_write=False, allow_create=False) # Find the user
