Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2026-01-18 05:22:10 +01:00
Code Issues Packages Projects Releases Activity

Prevent overwrite read only gpg keys (#1713)

Browse Source 
It was possible to download the default SCM-Manager gpg keys and overwrite them with the same raw key. This made the new key deletable. This behaviour is not longer possible.
This commit is contained in:
Eduard Heimbuch
2021-06-28 11:27:13 +02:00
committed by GitHub
parent 7a3db7ee3f
commit 2cd46ce8a0
3 changed files with 32 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
scm-webapp/src/main/java/sonia/scm/security/gpg/PublicKeyStore.java
View File

@@ -71,9 +71,14 @@ public class PublicKeyStore {
UserPermissions.changePublicKeys(username).check();
if (!rawKey.contains("PUBLIC KEY")) {
throw new NotPublicKeyException(ContextEntry.ContextBuilder.entity(RawGpgKey.class, displayName).build(), "The provided key is not a public key");
throw new NotPublicKeyException(
ContextEntry.ContextBuilder.entity(RawGpgKey.class, displayName).build(),
"The provided key is not a public key"
);
}
preventOverwriteReadOnlyKeys(rawKey);
Keys keys = Keys.resolve(rawKey);
String master = keys.getMaster();
@@ -90,6 +95,17 @@ public class PublicKeyStore {
}
private void preventOverwriteReadOnlyKeys(String rawKey) {
Optional<RawGpgKey> existingReadOnlyKey = store.getAll().values()
.stream()
.filter(k -> k.getRaw().trim().equals(rawKey.trim()))
.filter(RawGpgKey::isReadonly)
.findFirst();
if (existingReadOnlyKey.isPresent()) {
throw new DeletingReadonlyKeyNotAllowedException(existingReadOnlyKey.get().getId());
}
}
private Set<Person> getContactsFromPublicKey(String rawKey) {
List<String> userIds = new ArrayList<>();
PGPPublicKey publicKeyFromRawKey = extractPublicKey(rawKey);