screwdriver-api 8.0.204 → 8.0.206

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.204",
+  "version": "8.0.206",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/builds/listSecrets.js

@@ -35,6 +35,13 @@ module.exports = () => ({
                         throw boom.notFound('Build does not exist');
                     }
 
+                    // Ensure build scope tokens can only request secrets for their own build.
+                    if (credentials.scope.includes('build')) {
+                        if (parseInt(credentials.username, 10) !== parseInt(request.params.id, 10)) {
+                            throw boom.forbidden('Token does not have permission to this secret');
+                        }
+                    }
+
                     return build.secrets;
                 })
                 .then(secrets => {

package/plugins/pipelines/helper/updateAdmins.js

@@ -48,16 +48,26 @@ async function batchUpdatePipelineAdmins(pipelineConfigs, user, isSDAdmin, serve
             }
 
             if (!isSDAdmin) {
-                await user
-                    .getPermissions(pipeline.scmUri)
-                    // check if user has admin access
-                    .then(permissions => {
-                        if (!permissions.admin) {
-                            throw boom.forbidden(
-                                `User ${user.username} does not have admin permission for the pipeline (id=${pipeline.id}) repo and is not allowed to update admins`
-                            );
-                        }
-                    });
+                if (pipeline.scmContext !== user.scmContext) {
+                    throw boom.forbidden(
+                        `User ${user.username} and pipeline (id=${pipeline.id}) have different SCM contexts`
+                    );
+                }
+
+                let permissions;
+
+                try {
+                    permissions = await user.getPermissions(pipeline.scmUri);
+                } catch (error) {
+                    throw boom.boomify(error, { statusCode: error.statusCode });
+                }
+
+                // check if user has admin access
+                if (!permissions.admin) {
+                    throw boom.forbidden(
+                        `User ${user.username} does not have admin permission for the pipeline (id=${pipeline.id}) repo and is not allowed to update admins`
+                    );
+                }
             }
 
             // check if pipeline is being deleted

package/plugins/secrets/index.js

@@ -25,7 +25,6 @@ const secretsPlugin = {
          * @param {Array}   credentials.scope        Scope of the credential (user, build, admin)
          * @param {String}  [credentials.pipelineId] If credential is a build, this is the pipeline ID
          * @param {String}  [credentials.configPipelineId] If credential is a build, this is the parent pipeline ID
-         * @param {String}  [credentials.jobId]      If credential is a build, this is the job ID
          * @param {String}  [credentials.isPR]       If credential is a build, this is true if a PR
          * @param {Object}  secret                   Secret object from Hapi
          * @param {String}  permission               Required permission level
@@ -33,7 +32,7 @@ const secretsPlugin = {
          * @return {Boolean}
          */
         server.expose('canAccess', async (credentials, secret, permission, app) => {
-            const { userFactory, pipelineFactory } = app;
+            const { buildFactory, userFactory, pipelineFactory, jobFactory } = app;
             const { scmContext, scope, username } = credentials;
 
             // Get secret pipeline
@@ -66,6 +65,27 @@ const secretsPlugin = {
                 return false;
             }
 
+            // Check build scope
+            if (scope.includes('build')) {
+                const build = await buildFactory.get(username);
+
+                if (!build) {
+                    throw boom.notFound(`Build ${username} does not exist`);
+                }
+
+                const job = await jobFactory.get(build.jobId);
+
+                if (!job) {
+                    throw boom.notFound(`Job ${build.jobId} does not exist`);
+                }
+
+                const secrets = await job.secrets;
+
+                if (!secrets.some(jobSecret => jobSecret.id === secret.id)) {
+                    throw boom.forbidden('Token does not have permission to this secret');
+                }
+            }
+
             // Check if secret belongs to current pipeline or parent pipeline
             if (secret.pipelineId !== credentials.pipelineId && secret.pipelineId !== credentials.configPipelineId) {
                 throw boom.forbidden(`${username} is not allowed to access this secret`);