pulpcore 3.22.29__tar.gz → 3.22.31__tar.gz

{pulpcore-3.22.29 → pulpcore-3.22.31}/CHANGES.md

@@ -8,6 +8,38 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.22.31 (2024-10-01) {: #3.22.31 }
+
+### REST API {: #3.22.31-rest-api }
+
+#### Bugfixes {: #3.22.31-rest-api-bugfix }
+
+- Fixed a bug that caused Pulp to return duplicate content when a user was logged in as a
+  non-superuser while the content was part of multiple repositories.
+  [#3641](https://github.com/pulp/pulpcore/issues/3641)
+
+### Plugin API {: #3.22.31-plugin-api }
+
+No significant changes.
+
+---
+
+# ## 3.22.30 (2024-08-10) {: #3.22.30 }
+
+### REST API {: #3.22.30-rest-api }
+
+#### Bugfixes {: #3.22.30-rest-api-bugfix }
+
+- Fixed RBAC permissions being incorrectly assigned in tasks that create objects.
+  https://access.redhat.com/security/cve/cve-2024-7143
+  [#5683](https://github.com/pulp/pulpcore/issues/5683)
+
+### Plugin API {: #3.22.30-plugin-api }
+
+No significant changes.
+
+---
+
 ## 3.22.29 (2024-07-16) {: #3.22.29 }
 
 

{pulpcore-3.22.29 → pulpcore-3.22.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulpcore
-Version: 3.22.29
+Version: 3.22.31
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.22.29 → pulpcore-3.22.31}/functest_requirements.txt

@@ -8,3 +8,5 @@ python-gnupg
 
 # from pulp_file
 beautifulsoup4
+pytest-xdist
+pytest-timeout

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore/app/apps.py

@@ -207,7 +207,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.22.29"
+    version = "3.22.31"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore/app/models/task.py

@@ -14,6 +14,7 @@ from django.contrib.postgres.fields import ArrayField
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db import connection, models
 from django.utils import timezone
+from django_lifecycle import hook, AFTER_CREATE
 
 from pulpcore.app.models import (
     AutoAddObjPermsMixin,
@@ -231,6 +232,11 @@ class Task(BaseModel, AutoAddObjPermsMixin):
             task = Task.objects.get(pk=task_id)
         return task
 
+    @hook(AFTER_CREATE)
+    def add_role_dispatcher(self):
+        """Set the "core.task_user_dispatcher" role for the current user after creation."""
+        self.add_roles_for_object_creator("core.task_user_dispatcher")
+
     def set_running(self):
         """
         Set this Task to the running state, save it, and log output in warning cases.

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore/app/viewsets/content.py

@@ -121,7 +121,12 @@ class BaseContentViewSet(NamedModelViewSet):
                 repo_viewset = get_viewset_for_model(repo)()
                 setattr(repo_viewset, "request", self.request)
                 scoped_repos.extend(repo_viewset.get_queryset().values_list("pk", flat=True))
-            return qs.filter(repositories__in=scoped_repos)
+
+            # calling the distinct clause at end of the query ensures that no duplicates from
+            # joined tables will be returned to the end-user; this behaviour is documented at
+            # https://docs.djangoproject.com/en/3.2/topics/db/queries, in the section Spanning
+            # multi-valued relationships
+            return qs.filter(repositories__in=scoped_repos).distinct()
         return qs
 
 

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore/app/viewsets/task.py

@@ -133,8 +133,21 @@ class TaskViewSet(
             ],
         },
         "core.task_viewer": ["core.view_task"],
+        # This is a special role to designate the user who dispatched the task, it is assigned to
+        # the user on the object-level at task creation. It is not meant to be edited or manually
+        # added/removed from users.
+        "core.task_user_dispatcher": ["core.add_task"],
     }
 
+    def get_queryset(self):
+        qs = super().get_queryset()
+        if self.action in ("add_role", "remove_role"):
+            if "core.task_user_dispatcher" == self.request.data.get("role"):
+                raise ValidationError(
+                    _("core.task_user_dispatcher can not be added/removed from a task.")
+                )
+        return qs
+
     @extend_schema(
         description="This operation cancels a task.",
         summary="Cancel a task",

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore/tasking/pulpcore_worker.py

@@ -442,7 +442,24 @@ def _perform_task(task_pk, task_working_dir_rel_path):
     task.set_running()
     # Store the task id in the environment for `Task.current()`.
     os.environ["PULP_TASK_ID"] = str(task.pk)
-    user = get_users_with_perms(task, with_group_users=False).first()
+    # These queries were specifically constructed and ordered this way to ensure we have the highest
+    # chance of getting the user who dispatched the task since we don't have a user relation on the
+    # task model. The second query acts as a fallback to provide ZDU support. Future changes will
+    # require to keep these around till a breaking change release is planned (3.70 the earliest).
+    user = (
+        get_users_with_perms(
+            task,
+            only_with_perms_in=["core.add_task"],
+            with_group_users=False,
+            include_model_permissions=False,
+        ).first()
+        or get_users_with_perms(
+            task,
+            only_with_perms_in=["core.manage_roles_task"],
+            with_group_users=False,
+            include_model_permissions=False,
+        ).first()
+    )
     _set_current_user(user)
     set_guid(task.logging_cid)
 

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore/tests/functional/api/test_tasking.py

@@ -17,10 +17,16 @@ from pulpcore.tests.functional.utils import download_file
 def dispatch_task(pulpcore_client):
     def _dispatch_task(*args, **kwargs):
         cid = pulpcore_client.default_headers.get("Correlation-ID") or str(uuid4())
+        username = pulpcore_client.configuration.username
         commands = (
             "from django_guid import set_guid; "
             "from pulpcore.tasking.tasks import dispatch; "
             "from pulpcore.app.util import get_url; "
+            "from django.contrib.auth import get_user_model; "
+            "from django_currentuser.middleware import _set_current_user; "
+            "User = get_user_model(); "
+            f"user = User.objects.filter(username='{username}').first(); "
+            "_set_current_user(user); "
             f"set_guid({cid!r}); "
             f"task = dispatch(*{args!r}, **{kwargs!r}); "
             "print(get_url(task))"
@@ -296,3 +302,36 @@ def test_cancel_gooey_task(tasks_api_client, dispatch_task, monitor_task):
             task = tasks_api_client.read(task_href)
 
     assert task.state == "canceled"
+
+
+@pytest.mark.parallel
+def test_correct_task_ownership(dispatch_task, users_roles_api_client, gen_user):
+    """Test that tasks get the correct ownership when dispatched."""
+    alice = gen_user(model_roles=["core.task_viewer"])
+    bob = gen_user(model_roles=["file.filerepository_creator"])
+
+    with alice:
+        atask_href = dispatch_task("pulpcore.app.tasks.test.sleep", args=(0,))
+    aroles = users_roles_api_client.list(alice.user.pulp_href)
+    assert aroles.count == 3
+    roles = {r.role: r.content_object for r in aroles.results}
+    correct_roles = {
+        "core.task_owner": atask_href,
+        "core.task_user_dispatcher": atask_href,
+        "core.task_viewer": None,
+    }
+    assert roles == correct_roles
+
+    with bob:
+        btask_href = dispatch_task("pulpcore.app.tasks.test.sleep", args=(0,))
+    aroles = users_roles_api_client.list(alice.user.pulp_href)
+    assert aroles.count == 3
+    broles = users_roles_api_client.list(bob.user.pulp_href)
+    assert broles.count == 3
+    roles = {r.role: r.content_object for r in broles.results}
+    correct_roles = {
+        "core.task_owner": btask_href,
+        "core.task_user_dispatcher": btask_href,
+        "file.filerepository_creator": None,
+    }
+    assert roles == correct_roles

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore/tests/functional/api/test_workers.py

@@ -76,7 +76,7 @@ def task_schedule(cli_client):
         "from django.utils.timezone import now;"
         "from datetime import timedelta;"
         "from pulpcore.app.models import TaskSchedule;"
-        "dispatch_interval = timedelta(seconds=4);"
+        "dispatch_interval = timedelta(seconds=5);"
         "next_dispatch = now() + dispatch_interval;"
         "TaskSchedule("
         f"    name='{name}', task_name='{task_name}', "
@@ -100,8 +100,9 @@ def task_schedule(cli_client):
 def test_task_schedule(task_schedule, task_schedules_api_client):
     """Test that a worker will schedule a task roughly at a given time."""
     # Worker TTL is configured to 30s, therefore they will have a heartbeat each 10s (6 bpm). The
-    # task is scheduled 4s in the future to give us time to invesitgate the state before and after.
-    # 15s later we can be sure it was scheduled (as long as at least one worker is running).
+    # task is scheduled 5s in the future to give us time to invesitgate the state before and after.
+    # 16s later we can be sure it was scheduled (as long as at least one worker is running).
+    # Waiting for 18s to give some more slack.
 
     result = task_schedules_api_client.list(name=task_schedule["name"])
     assert result.count == 1
@@ -110,7 +111,7 @@ def test_task_schedule(task_schedule, task_schedules_api_client):
     assert ts.task_name == task_schedule["task_name"]
     assert ts.last_task is None
     # At least a worker heartbeat is needed
-    for i in range(15):
+    for i in range(18):
         sleep(1)
         ts = task_schedules_api_client.read(task_schedule_href=result.results[0].pulp_href)
         if ts.last_task is not None:

{pulpcore-3.22.29 → pulpcore-3.22.31}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulpcore
-Version: 3.22.29
+Version: 3.22.31
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.22.29 → pulpcore-3.22.31}/setup.py

@@ -8,7 +8,7 @@ with open("requirements.txt") as requirements:
 
 setup(
     name="pulpcore",
-    version="3.22.29",
+    version="3.22.31",
     description="Pulp Django Application and Related Modules",
     long_description=long_description,
     long_description_content_type="text/markdown",