pulpcore 3.28.30__tar.gz → 3.28.32__tar.gz

{pulpcore-3.28.30 → pulpcore-3.28.32}/CHANGES.md

@@ -8,6 +8,35 @@
 
 [//]: # (towncrier release notes start)
 
+# ## 3.28.32 (2024-08-10) {: #3.28.32 }
+
+### REST API {: #3.28.32-rest-api }
+
+#### Bugfixes {: #3.28.32-rest-api-bugfix }
+
+- Fixed RBAC permissions being incorrectly assigned in tasks that create objects.
+  https://access.redhat.com/security/cve/cve-2024-7143
+  [#5683](https://github.com/pulp/pulpcore/issues/5683)
+
+### Plugin API {: #3.28.32-plugin-api }
+
+No significant changes.
+
+---
+
+## 3.28.31 (2024-07-23) {: #3.28.31 }
+
+
+### REST API {: #3.28.31-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.28.31-plugin-api }
+
+No significant changes.
+
+---
+
 ## 3.28.30 (2024-07-16) {: #3.28.30 }
 
 

{pulpcore-3.28.30 → pulpcore-3.28.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulpcore
-Version: 3.28.30
+Version: 3.28.32
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.28.30 → pulpcore-3.28.32}/pulpcore/app/apps.py

@@ -234,7 +234,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.28.30"
+    version = "3.28.32"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.28.30 → pulpcore-3.28.32}/pulpcore/app/models/task.py

@@ -13,6 +13,7 @@ from django.contrib.postgres.fields import ArrayField, HStoreField
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db import connection, models
 from django.utils import timezone
+from django_lifecycle import hook, AFTER_CREATE
 
 from pulpcore.app.models import (
     AutoAddObjPermsMixin,
@@ -225,6 +226,11 @@ class Task(BaseModel, AutoAddObjPermsMixin):
         """
         return current_task.get()
 
+    @hook(AFTER_CREATE)
+    def add_role_dispatcher(self):
+        """Set the "core.task_user_dispatcher" role for the current user after creation."""
+        self.add_roles_for_object_creator("core.task_user_dispatcher")
+
     def set_running(self):
         """
         Set this Task to the running state, save it, and log output in warning cases.

{pulpcore-3.28.30 → pulpcore-3.28.32}/pulpcore/app/viewsets/task.py

@@ -143,6 +143,10 @@ class TaskViewSet(
             ],
         },
         "core.task_viewer": ["core.view_task"],
+        # This is a special role to designate the user who dispatched the task, it is assigned to
+        # the user on the object-level at task creation. It is not meant to be edited or manually
+        # added/removed from users.
+        "core.task_user_dispatcher": ["core.add_task"],
     }
 
     def get_serializer(self, *args, **kwargs):
@@ -191,6 +195,11 @@ class TaskViewSet(
                 ),
                 Prefetch("child_tasks", queryset=Task.objects.only("pk")),
             )
+        if self.action in ("add_role", "remove_role"):
+            if "core.task_user_dispatcher" == self.request.data.get("role"):
+                raise ValidationError(
+                    _("core.task_user_dispatcher can not be added/removed from a task.")
+                )
         return qs
 
     @extend_schema(

{pulpcore-3.28.30 → pulpcore-3.28.32}/pulpcore/tasking/pulpcore_worker.py

@@ -436,7 +436,26 @@ def _perform_task(task_pk, task_working_dir_rel_path):
     # All processes need to create their own postgres connection
     connection.connection = None
     task = Task.objects.select_related("pulp_domain").get(pk=task_pk)
-    user = get_users_with_perms(task, with_group_users=False).first()
+    # These queries were specifically constructed and ordered this way to ensure we have the highest
+    # chance of getting the user who dispatched the task since we don't have a user relation on the
+    # task model. The second query acts as a fallback to provide ZDU support. Future changes will
+    # require to keep these around till a breaking change release is planned (3.70 the earliest).
+    user = (
+        get_users_with_perms(
+            task,
+            only_with_perms_in=["core.add_task"],
+            with_group_users=False,
+            include_model_permissions=False,
+            include_domain_permissions=False,
+        ).first()
+        or get_users_with_perms(
+            task,
+            only_with_perms_in=["core.manage_roles_task"],
+            with_group_users=False,
+            include_model_permissions=False,
+            include_domain_permissions=False,
+        ).first()
+    )
     # Set current contexts
     set_guid(task.logging_cid)
     set_current_user(user)

{pulpcore-3.28.30 → pulpcore-3.28.32}/pulpcore/tests/functional/api/test_tasking.py

@@ -322,3 +322,40 @@ def test_task_created_by(dispatch_task, monitor_task, gen_user, anonymous_user):
         task_href = dispatch_task("time.sleep", (0,))
     anon_task = monitor_task(task_href)
     assert anon_task.created_by is None
+
+
+@pytest.mark.parallel
+def test_correct_task_ownership(
+    dispatch_task, users_roles_api_client, gen_user, file_repository_factory
+):
+    """Test that tasks get the correct ownership when dispatched."""
+    alice = gen_user(model_roles=["core.task_viewer"])
+    bob = gen_user(model_roles=["file.filerepository_creator"])
+
+    with alice:
+        atask_href = dispatch_task("pulpcore.app.tasks.test.sleep", args=(0,))
+    aroles = users_roles_api_client.list(alice.user.pulp_href)
+    assert aroles.count == 3
+    roles = {r.role: r.content_object for r in aroles.results}
+    correct_roles = {
+        "core.task_owner": atask_href,
+        "core.task_user_dispatcher": atask_href,
+        "core.task_viewer": None,
+    }
+    assert roles == correct_roles
+
+    with bob:
+        btask_href = dispatch_task("pulpcore.app.tasks.test.sleep", args=(0,))
+        repo = file_repository_factory()
+    aroles = users_roles_api_client.list(alice.user.pulp_href)
+    assert aroles.count == 3
+    broles = users_roles_api_client.list(bob.user.pulp_href)
+    assert broles.count == 4
+    roles = {r.role: r.content_object for r in broles.results}
+    correct_roles = {
+        "core.task_owner": btask_href,
+        "core.task_user_dispatcher": btask_href,
+        "file.filerepository_owner": repo.pulp_href,
+        "file.filerepository_creator": None,
+    }
+    assert roles == correct_roles

{pulpcore-3.28.30 → pulpcore-3.28.32}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulpcore
-Version: 3.28.30
+Version: 3.28.32
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.28.30 → pulpcore-3.28.32}/pulpcore.egg-info/requires.txt

@@ -4,7 +4,7 @@ aiohttp<3.9.6,>=3.8.1
 asyncio-throttle<=1.0.2,>=1.0
 backoff<2.2.2,>=2.1.2
 click<=8.1.7,>=8.1.0
-cryptography<41.0.8,>=38.0.1
+cryptography<42.0.9,>=38.0.1
 Django~=4.2.0
 django-filter<=23.5,>=23.1
 django-guid<=3.4.0,>=3.3

{pulpcore-3.28.30 → pulpcore-3.28.32}/requirements.txt

@@ -5,7 +5,7 @@ asyncio-throttle>=1.0,<=1.0.2
 async-timeout>=4.0.3,<4.0.4;python_version<"3.11"
 backoff>=2.1.2,<2.2.2
 click>=8.1.0,<=8.1.7
-cryptography>=38.0.1,<41.0.8
+cryptography>=38.0.1,<42.0.9
 Django~=4.2.0  # LTS version, switch only if we have a compelling reason to
 django-filter>=23.1,<=23.5
 django-guid>=3.3,<=3.4.0

{pulpcore-3.28.30 → pulpcore-3.28.32}/setup.py

@@ -8,7 +8,7 @@ with open("requirements.txt") as requirements:
 
 setup(
     name="pulpcore",
-    version="3.28.30",
+    version="3.28.32",
     description="Pulp Django Application and Related Modules",
     long_description=long_description,
     long_description_content_type="text/markdown",