debian-mirror-gitlab/debian/patches/cve-2017-0925.patch
2018-03-15 11:46:59 +05:30

39 lines
1.2 KiB
Diff

--- a/app/models/service.rb
+++ b/app/models/service.rb
@@ -98,6 +98,11 @@
nil
end
+ def api_field_names
+ fields.map { |field| field[:name] }
+ .reject { |field_name| field_name =~ /(password|token|key)/ }
+ end
+
def global_fields
fields
end
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -411,10 +411,7 @@
expose :tag_push_events, :note_events, :build_events, :pipeline_events
# Expose serialized properties
expose :properties do |service, options|
- field_names = service.fields.
- select { |field| options[:include_passwords] || field[:type] != 'password' }.
- map { |field| field[:name] }
- service.properties.slice(*field_names)
+ service.properties.slice(*service.api_field_names)
end
end
--- a/lib/api/services.rb
+++ b/lib/api/services.rb
@@ -56,7 +56,7 @@
# GET /project/:id/services/gitlab-ci
#
get ':id/services/:service_slug' do
- present project_service, with: Entities::ProjectService, include_passwords: current_user.is_admin?
+ present project_service, with: Entities::ProjectService
end
end
end