This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit c6f48a4ae209ad54b8e3d2be3ad91d3788aeda88 Author: Dave Brondsema <[email protected]> AuthorDate: Thu Jun 4 14:30:12 2026 -0400 [#8607] lock down get_markdown content type and only to those who could use it to update anyway --- Allura/allura/controllers/discuss.py | 3 ++- Allura/allura/controllers/repository.py | 3 ++- Allura/allura/tests/functional/test_discuss.py | 1 + ForgeBlog/forgeblog/main.py | 3 ++- ForgeBlog/forgeblog/tests/functional/test_root.py | 1 + ForgeGit/forgegit/tests/functional/test_controllers.py | 1 + ForgeTracker/forgetracker/tests/functional/test_root.py | 1 + ForgeTracker/forgetracker/tracker_main.py | 3 ++- ForgeWiki/forgewiki/tests/functional/test_root.py | 1 + ForgeWiki/forgewiki/wiki_main.py | 3 ++- 10 files changed, 15 insertions(+), 5 deletions(-) diff --git a/Allura/allura/controllers/discuss.py b/Allura/allura/controllers/discuss.py index 9340916f9..5aceca93f 100644 --- a/Allura/allura/controllers/discuss.py +++ b/Allura/allura/controllers/discuss.py @@ -398,9 +398,10 @@ def update_markdown(self, text=None, **kw): 'status': 'no_permission' } - @expose() + @expose(content_type='text/plain') @without_trailing_slash def get_markdown(self): + require_access(self.post, 'moderate') return self.post.text @expose('json:') diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py index 228142500..de6b72ece 100644 --- a/Allura/allura/controllers/repository.py +++ b/Allura/allura/controllers/repository.py @@ -551,9 +551,10 @@ def update_markdown(self, text=None, **kw): 'status': 'no_permission' } - @expose() + @expose(content_type='text/plain') @without_trailing_slash def get_markdown(self): + require_access(self.req, 'write') return self.req.description @expose() diff --git a/Allura/allura/tests/functional/test_discuss.py b/Allura/allura/tests/functional/test_discuss.py index 7592c870e..6d3bd0251 100644 --- a/Allura/allura/tests/functional/test_discuss.py +++ b/Allura/allura/tests/functional/test_discuss.py @@ -209,6 +209,7 @@ def test_comment_get_markdown(self): post_id = str( r.html.find('div', {'class': 'discussion-post'})['id']) response = self.app.get(self._thread_link() + post_id + '/get_markdown') + assert response.content_type == 'text/plain' assert 'This is a post' in response def test_comment_update_markdown(self): diff --git a/ForgeBlog/forgeblog/main.py b/ForgeBlog/forgeblog/main.py index 9dce9b057..02b0596a4 100644 --- a/ForgeBlog/forgeblog/main.py +++ b/ForgeBlog/forgeblog/main.py @@ -473,9 +473,10 @@ def update_markdown(self, text=None, **kw): 'status': 'no_permission' } - @expose() + @expose(content_type='text/plain') @without_trailing_slash def get_markdown(self): + require_access(self.post, 'edit') return self.post.text @without_trailing_slash diff --git a/ForgeBlog/forgeblog/tests/functional/test_root.py b/ForgeBlog/forgeblog/tests/functional/test_root.py index b5c5ccd24..79bed33fc 100644 --- a/ForgeBlog/forgeblog/tests/functional/test_root.py +++ b/ForgeBlog/forgeblog/tests/functional/test_root.py @@ -165,6 +165,7 @@ def test_post_get_markdown(self): self._post() d = self._blog_date() response = self.app.get('/blog/%s/my-post/get_markdown' % d) + assert response.content_type == 'text/plain' assert 'Nothing' in response def test_post_update_markdown(self): diff --git a/ForgeGit/forgegit/tests/functional/test_controllers.py b/ForgeGit/forgegit/tests/functional/test_controllers.py index e2bf0d00c..fb986710a 100644 --- a/ForgeGit/forgegit/tests/functional/test_controllers.py +++ b/ForgeGit/forgegit/tests/functional/test_controllers.py @@ -962,6 +962,7 @@ def test_merge_request_get_markdown(self): 'description': 'description', }) response = self.app.get('/p/test/src-git/merge-requests/1/get_markdown') + assert response.content_type == 'text/plain' assert 'description' in response def test_merge_request_update_markdown(self): diff --git a/ForgeTracker/forgetracker/tests/functional/test_root.py b/ForgeTracker/forgetracker/tests/functional/test_root.py index acd307dc1..528a81a77 100644 --- a/ForgeTracker/forgetracker/tests/functional/test_root.py +++ b/ForgeTracker/forgetracker/tests/functional/test_root.py @@ -298,6 +298,7 @@ def test_new_ticket(self): def test_ticket_get_markdown(self): self.new_ticket(summary='my ticket', description='my description') response = self.app.get('/bugs/1/get_markdown') + assert response.content_type == 'text/plain' assert 'my description' in response def test_ticket_update_markdown(self): diff --git a/ForgeTracker/forgetracker/tracker_main.py b/ForgeTracker/forgetracker/tracker_main.py index a3482cf70..3160b6b35 100644 --- a/ForgeTracker/forgetracker/tracker_main.py +++ b/ForgeTracker/forgetracker/tracker_main.py @@ -1573,9 +1573,10 @@ def update_markdown(self, text=None, **kw): 'status': 'no_permission' } - @expose() + @expose(content_type='text/plain') @without_trailing_slash def get_markdown(self): + require_access(self.ticket, 'update') return self.ticket.description @expose('json:') diff --git a/ForgeWiki/forgewiki/tests/functional/test_root.py b/ForgeWiki/forgewiki/tests/functional/test_root.py index 7b5b30a4f..0fba9054b 100644 --- a/ForgeWiki/forgewiki/tests/functional/test_root.py +++ b/ForgeWiki/forgewiki/tests/functional/test_root.py @@ -432,6 +432,7 @@ def test_page_get_markdown(self): 'labels': '', }) response = self.app.get(h.urlquote('/wiki/tést/get_markdown')) + assert response.content_type == 'text/plain' assert '- [ ] checkbox' in response def test_page_update_markdown(self): diff --git a/ForgeWiki/forgewiki/wiki_main.py b/ForgeWiki/forgewiki/wiki_main.py index d93d56feb..c2c93b50c 100644 --- a/ForgeWiki/forgewiki/wiki_main.py +++ b/ForgeWiki/forgewiki/wiki_main.py @@ -818,8 +818,9 @@ def update_markdown(self, text=None, **kw): } @without_trailing_slash - @expose() + @expose(content_type='text/plain') def get_markdown(self): + require_access(self.page, 'edit') return self.page.text @without_trailing_slash
