pulpcore 3.49.65__tar.gz → 3.49.67__tar.gz

{pulpcore-3.49.65 → pulpcore-3.49.67}/CHANGES.md

@@ -8,6 +8,51 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.49.67 (2026-07-28) {: #3.49.67 }
+
+### REST API {: #3.49.67-rest-api }
+
+#### Bugfixes {: #3.49.67-rest-api-bugfix }
+
+- Fixed domain list returning all domains to authenticated users instead of only domains they can view.
+  [#7898](https://github.com/pulp/pulpcore/issues/7898)
+
+### Plugin API {: #3.49.67-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.49.67-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.49.67-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.49.66 (2026-07-20) {: #3.49.66 }
+
+### REST API {: #3.49.66-rest-api }
+
+#### Bugfixes {: #3.49.66-rest-api-bugfix }
+
+- Improved validation of relative paths to prevent a path traversal attack in filesystem exports. (CVE-2026-12701)
+
+### Plugin API {: #3.49.66-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.49.66-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.49.66-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.49.65 (2026-07-16) {: #3.49.65 }
 
 ### REST API {: #3.49.65-rest-api }

{pulpcore-3.49.65 → pulpcore-3.49.67}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.49.65
+Version: 3.49.67
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.49.65"
+    version = "3.49.67"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.49.65"
+    version = "3.49.67"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulp_file/tests/functional/api/test_domains.py

@@ -3,7 +3,7 @@ import uuid
 
 import pytest
 
-from pulpcore.app import settings
+from pulpcore.app import settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.client.pulp_file import ApiException
 from pulpcore.client.pulpcore import ApiException as CoreApiException
 from pulpcore.client.pulpcore import Repair

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulp_file/tests/functional/api/test_pulp_export.py

@@ -2,7 +2,7 @@ import uuid
 
 import pytest
 
-from pulpcore.app import settings
+from pulpcore.app import settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.client.pulpcore.exceptions import ApiException
 from pulpcore.constants import TASK_STATES
 

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/apps.py

@@ -242,7 +242,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.49.65"
+    version = "3.49.67"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/authentication.py

@@ -10,7 +10,7 @@ from django.contrib.auth.backends import RemoteUserBackend
 from rest_framework.authentication import BaseAuthentication, RemoteUserAuthentication
 from rest_framework.exceptions import AuthenticationFailed
 
-from pulpcore.app import settings
+from pulpcore.app import settings  # noqa: TID251 Unfixable in old dynaconf version.
 
 _logger = logging.getLogger(__name__)
 

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/redis_connection.py

@@ -1,7 +1,7 @@
 from redis import Redis
 from redis.asyncio import Redis as aRedis
 
-from pulpcore.app.settings import settings
+from pulpcore.app.settings import settings  # noqa: TID251 Unfixable in old dynaconf version.
 
 _conn = None
 _a_conn = None

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/serializers/exporter.py

@@ -5,7 +5,7 @@ from gettext import gettext as _
 from rest_framework import serializers
 from rest_framework.validators import UniqueValidator
 
-from pulpcore.app import models, settings
+from pulpcore.app import models, settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.app.serializers import (
     DetailIdentityField,
     DetailRelatedField,

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/serializers/fields.py

@@ -20,6 +20,10 @@ def relative_path_validator(relative_path):
         raise serializers.ValidationError(
             _("Relative path can't start with '/'. {0}").format(relative_path)
         )
+    if os.path.normpath(relative_path).startswith("../"):
+        raise serializers.ValidationError(
+            _("Relative path must not reach beyond the base path. {0}").format(relative_path)
+        )
 
 
 @extend_schema_field(OpenApiTypes.OBJECT)

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/serializers/importer.py

@@ -5,7 +5,7 @@ from django.core.exceptions import ObjectDoesNotExist
 from rest_framework import serializers
 from rest_framework.validators import UniqueValidator
 
-from pulpcore.app import models, settings
+from pulpcore.app import models, settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.app.serializers import (
     DetailIdentityField,
     ImportIdentityField,

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/serializers/repository.py

@@ -6,7 +6,7 @@ from cryptography.x509 import load_pem_x509_certificate
 from rest_framework import fields, serializers
 from rest_framework_nested.serializers import NestedHyperlinkedModelSerializer
 
-from pulpcore.app import models, settings
+from pulpcore.app import models, settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.app.serializers import (
     DetailIdentityField,
     DetailRelatedField,

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/tasks/export.py

@@ -29,7 +29,7 @@ from pulpcore.app.models import (
     Task,
 )
 from pulpcore.app.models.content import ContentArtifact
-from pulpcore.app.serializers import PulpExportSerializer
+from pulpcore.app.serializers import PulpExportSerializer, relative_path_validator
 from pulpcore.app.util import Crc32Hasher, compute_file_hash
 from pulpcore.constants import FS_EXPORT_METHODS
 
@@ -98,6 +98,7 @@ def _export_to_file_system(path, relative_paths_to_artifacts, method=FS_EXPORT_M
         method = FS_EXPORT_METHODS.WRITE
 
     for relative_path, artifact in relative_paths_to_artifacts.items():
+        relative_path_validator(relative_path)
         dest = os.path.join(path, relative_path)
         os.makedirs(os.path.split(dest)[0], exist_ok=True)
 

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/views/importer.py

@@ -6,7 +6,7 @@ from drf_spectacular.utils import extend_schema
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
-from pulpcore.app import settings
+from pulpcore.app import settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.app.serializers import PulpImportCheckResponseSerializer, PulpImportCheckSerializer
 
 

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/app/viewsets/domain.py

@@ -37,6 +37,7 @@ class DomainViewSet(
     serializer_class = DomainSerializer
     endpoint_name = "domains"
     filterset_class = DomainFilter
+    queryset_filtering_required_permission = "core.view_domain"
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/cache/cache.py

@@ -15,7 +15,7 @@ from pulpcore.app.redis_connection import (
     get_async_redis_connection,
     get_redis_connection,
 )
-from pulpcore.app.settings import settings
+from pulpcore.app.settings import settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.responses import ArtifactResponse
 
 DEFAULT_EXPIRES_TTL = settings.CACHE_SETTINGS["EXPIRES_TTL"]

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/tests/functional/api/test_auth.py

@@ -9,7 +9,7 @@ from base64 import b64encode
 
 import pytest
 
-from pulpcore.app import settings
+from pulpcore.app import settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.client.pulpcore import ApiException
 
 

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/tests/functional/api/test_crud_domains.py

@@ -310,3 +310,41 @@ def test_special_domain_creation(domains_api_client, gen_object_with_cleanup, pu
     domain = gen_object_with_cleanup(domains_api_client, body, pulp_domain=random_name)
     assert "default/api/v3/" in domain.pulp_href
     assert random_name not in domain.pulp_href
+
+
+@pytest.mark.parallel
+def test_domain_list_queryset_scoping(pulpcore_bindings, gen_user, gen_object_with_cleanup):
+    """Test that domain list is scoped to domains the user can view."""
+    body = {
+        "name": str(uuid.uuid4()),
+        "storage_class": "pulpcore.app.models.storage.FileSystem",
+        "storage_settings": {"MEDIA_ROOT": ""},
+    }
+    domain = gen_object_with_cleanup(pulpcore_bindings.DomainsApi, body)
+    gen_object_with_cleanup(pulpcore_bindings.DomainsApi, {**body, "name": str(uuid.uuid4())})
+
+    # Authenticated users without view_domain see no domains
+    with gen_user():
+        assert pulpcore_bindings.DomainsApi.list().count == 0
+
+    # Object-level domain_viewer can see only that domain
+    with gen_user(object_roles=[("core.domain_viewer", domain.pulp_href)]):
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == domain.pulp_href
+
+    # Object-level domain_owner can see only that domain
+    with gen_user(object_roles=[("core.domain_owner", domain.pulp_href)]):
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == domain.pulp_href
+
+    # Domain creator sees domains they create (via creation_hooks), not others
+    creator = gen_user(model_roles=["core.domain_creator"])
+    with creator:
+        created = gen_object_with_cleanup(
+            pulpcore_bindings.DomainsApi, {**body, "name": str(uuid.uuid4())}
+        )
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == created.pulp_href

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/tests/functional/api/using_plugin/test_filesystemexport.py

@@ -9,7 +9,7 @@ import uuid
 
 import pytest
 
-from pulpcore.app import settings
+from pulpcore.app import settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.client.pulp_file import RepositorySyncURL
 from pulpcore.client.pulpcore.exceptions import ApiException
 

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore/tests/functional/api/using_plugin/test_pulpimport.py

@@ -12,7 +12,7 @@ from pathlib import Path
 
 import pytest
 
-from pulpcore.app import settings
+from pulpcore.app import settings  # noqa: TID251 Unfixable in old dynaconf version.
 from pulpcore.client.pulp_file import RepositorySyncURL
 from pulpcore.client.pulpcore.exceptions import ApiException
 

pulpcore-3.49.67/pulpcore/tests/unit/serializers/test_fields.py

@@ -0,0 +1,17 @@
+import pytest
+from rest_framework import serializers
+
+from pulpcore.app.serializers.fields import relative_path_validator
+
+
+@pytest.mark.parametrize(
+    ("path",),
+    [
+        pytest.param("/absolute/path", id="absolute"),
+        pytest.param("../sneaky/path", id="path_traversal"),
+        pytest.param("suspicious/../../sneaky/path", id="hidden_path_traversal"),
+    ],
+)
+def test_relative_path_validator_rejects(path):
+    with pytest.raises(serializers.ValidationError):
+        relative_path_validator(path)

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.49.65
+Version: 3.49.67
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.49.65 → pulpcore-3.49.67}/pulpcore.egg-info/SOURCES.txt

@@ -502,6 +502,7 @@ pulpcore/tests/unit/roles/test_roles.py
 pulpcore/tests/unit/serializers/__init__.py
 pulpcore/tests/unit/serializers/test_base.py
 pulpcore/tests/unit/serializers/test_domain.py
+pulpcore/tests/unit/serializers/test_fields.py
 pulpcore/tests/unit/serializers/test_pulpexport.py
 pulpcore/tests/unit/serializers/test_repository.py
 pulpcore/tests/unit/stages/__init__.py

{pulpcore-3.49.65 → pulpcore-3.49.67}/pyproject.toml

@@ -105,7 +105,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.49.65"
+current_version = "3.49.67"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"
@@ -161,7 +161,6 @@ replace = "version = \"{new_version}\""
 [[tool.bumpversion.files]]
 filename = "./setup.py"
 
-
 [tool.ruff]
 # This section is managed by the plugin template. Do not edit manually.
 line-length = 100
@@ -173,6 +172,7 @@ extend-exclude = [
 
 [tool.ruff.lint]
 # This section is managed by the plugin template. Do not edit manually.
+select = ["E4", "E7", "E9", "F"]
 extend-select = [
   "I",
   "INT",
@@ -183,6 +183,7 @@ extend-select = [
 [tool.ruff.lint.flake8-tidy-imports.banned-api]
 # This section is managed by the plugin template. Do not edit manually.
 "distutils".msg = "The 'distutils' module has been deprecated since Python 3.9."
+"pulpcore.app.settings".msg = "Always import 'settings' from 'django.conf' instead."
 
 [tool.ruff.lint.isort]
 # This section is managed by the plugin template. Do not edit manually.

{pulpcore-3.49.65 → pulpcore-3.49.67}/setup.py

@@ -8,7 +8,7 @@ with open("requirements.txt") as requirements:
 
 setup(
     name="pulpcore",
-    version="3.49.65",
+    version="3.49.67",
     description="Pulp Django Application and Related Modules",
     long_description=long_description,
     long_description_content_type="text/markdown",