Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

stable

Clone or download

Read-only

Ownership of the file must be proved before being added to a repository

Download Browse

Currrently once the a file has been uploaded once on the instance all the checks are bypassed and the file can be added to any repository without needing to upload it again. While this save bandwith and save the uploader some time, it also means that a malicious user can get access to any objects available on the instance as soon as it knows the object ID. This is part of story #12322: have git-lfs batch and basic transfer API Change-Id: I8fcb78da8d7f298c6a2d7a2a0eeef94145442379

+108 −27
Thomas Gerbet (tgerbet) 2018-12-03 22:25
Thomas Gerbet (tgerbet) 2018-12-03 22:52
aefd34e3c148a3b7688bd6673090aa1dfb59c9fb
8c32d5b82d10aa42d85f97b4587b381a83dacba6
git #tuleap/stable/aefd34e3c148a3b7688bd6673090aa1dfb59c9fb

Modified Files

Side by side diff
Inline diff
Name
M plugins/gitlfs/include/LFSObject/LFSObjectPathAllocator.php +4 −4 Go to diff View file
M plugins/gitlfs/include/LFSObject/LFSObjectRetriever.php +8 −0 Go to diff View file
M plugins/gitlfs/include/Transfer/Basic/LFSBasicTransferObjectSaver.php +14 −10 Go to diff View file
M plugins/gitlfs/include/Transfer/Basic/LFSBasicTransferUploadController.php +1 −0 Go to diff View file
M plugins/gitlfs/include/Transfer/LFSTransferVerifier.php +17 −3 Go to diff View file
M plugins/gitlfs/phpunit/LFSObject/LFSObjectRetrieverTest.php +23 −0 Go to diff View file
M plugins/gitlfs/phpunit/Transfer/Basic/LFSBasicTransferObjectSaverTest.php +18 −10 Go to diff View file
M plugins/gitlfs/phpunit/Transfer/LFSTransferVerifierTest.php +23 −0 Go to diff View file