diff --git a/doc/CHANGELOG.rdoc b/doc/CHANGELOG.rdoc index 0d28a2460885145d41382ae9d7c915b2becc746d..1ff69ebf2e57b14039a24d439f69d441acebae1c 100644 --- a/doc/CHANGELOG.rdoc +++ b/doc/CHANGELOG.rdoc @@ -1,5 +1,9 @@ = ChiliProject changelog +== 2011-11-30 v1.5.5 + +* Bug #709: Redmine.pm potential security issue with cache credential enabled and subversion + == 2011-10-31 v1.5.4 * Bug #647: XSS: User input for images is not properly sanitized diff --git a/extra/svn/Redmine.pm b/extra/svn/Redmine.pm index b73c853de190a813223429fba2a9c26443303d2f..7ff93ed73d90e2c17f7131bee2bff7672a951e45 100644 --- a/extra/svn/Redmine.pm +++ b/extra/svn/Redmine.pm @@ -438,10 +438,12 @@ sub is_member { my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass); + my $access_mode = request_is_read_only($r) ? "R" : "W"; + my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config); my $usrprojpass; if ($cfg->{RedmineCacheCredsMax}) { - $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id); + $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id.":".$access_mode); return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest)); } my $query = $cfg->{RedmineQuery}; @@ -484,10 +486,10 @@ sub is_member { if ($cfg->{RedmineCacheCredsMax} and $ret) { if (defined $usrprojpass) { - $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest); + $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest); } else { if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) { - $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest); + $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest); $cfg->{RedmineCacheCredsCount}++; } else { $cfg->{RedmineCacheCreds}->clear(); diff --git a/lib/redmine/version.rb b/lib/redmine/version.rb index 7bfd98c9c9c3d64d3b81579c3d5a8a4fe5b401a6..0d9a6f630b4c9d3d4a4fef2e9c0de44039bcad46 100644 --- a/lib/redmine/version.rb +++ b/lib/redmine/version.rb @@ -4,7 +4,7 @@ module Redmine module VERSION #:nodoc: MAJOR = 1 MINOR = 5 - PATCH = 4 + PATCH = 5 TINY = PATCH # Redmine compat def self.revision