hub: Check permissions for uploads before using them

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/buildservice/uploads.py b/src/buildservice/uploads.py
index b910d3a653a28b9bac1ca2cf93cecdb7d1a00ed4..cc926cd4b0852dcbedc7f131eedef0ec84306b17 100644 (file)
--- a/src/buildservice/uploads.py
+++ b/src/buildservice/uploads.py
@@ -172,6 +172,16 @@ class Upload(base.DataObject):
 
        user = lazy_property(get_user, set_user)
 
+       def has_perm(self, who):
+               """
+                       Returns True if "who" has permissions to use this upload
+               """
+               if self.builder == who or self.user == who:
+                       return True
+
+               # No permission
+               return False
+
        async def delete(self):
                log.info("Deleting upload %s (%s)" % (self, self.path))
 

diff --git a/src/hub/builds.py b/src/hub/builds.py
index 4c95783be2d0a91c06a7cf41d4d4f2273ee11a24..bc41ae45799800fed1ef0642c01d8626c8cd345a 100644 (file)
--- a/src/hub/builds.py
+++ b/src/hub/builds.py
@@ -30,7 +30,9 @@ class CreateHandler(BaseHandler):
                if not upload:
                        raise tornado.web.HTTPError(404, "Could not find upload")
 
-               # XXX check permissions of the upload
+               # Check permissions of the upload
+               if not upload.has_perm(self.current_user):
+                       raise tornado.web.HTTPError(403, "No permission for using upload %s" % upload)
 
                with self.db.transaction():
                        # Try opening the archive