lib: Grant SELECT on auth_user

If a mail arrives with the 'X-Patchwork-Delegate' hint header, the
'patchwork.parser' script will need to index the users table to find the
appropriate user. This should be okay from a security perspective since
passwords are hashed and salted and the rest of the information is
mostly accessible publicly via the web UI and REST API.

Signed-off-by: Stephen Finucane <stephen@that.guru>
Suggested-by: Ali Alnubani <alialnu@mellanox.com>
Closes: #365
(cherry picked from commit e69a2adcf50b57980d5eb0074cc72698d5cac31a)

diff --git a/lib/sql/grant-all.mysql.sql b/lib/sql/grant-all.mysql.sql
index 100cd387fd08c64e07263adaf3a3e8001f7608cc..c8044c6892acaa7b65136211948783217abb9ffa 100644 (file)
--- a/lib/sql/grant-all.mysql.sql
+++ b/lib/sql/grant-all.mysql.sql
@@ -46,6 +46,7 @@ GRANT INSERT, SELECT ON patchwork_series TO 'nobody'@localhost;
 GRANT INSERT, SELECT ON patchwork_seriesreference TO 'nobody'@localhost;
 GRANT INSERT, SELECT ON patchwork_submission TO 'nobody'@localhost;
 GRANT INSERT, SELECT, UPDATE, DELETE ON patchwork_patchtag TO 'nobody'@localhost;
+GRANT SELECT ON auth_user TO 'nobody'@localhost;
 GRANT SELECT ON patchwork_delegationrule TO 'nobody'@localhost;
 GRANT SELECT ON        patchwork_project TO 'nobody'@localhost;
 GRANT SELECT ON patchwork_state TO 'nobody'@localhost;

diff --git a/lib/sql/grant-all.postgres.sql b/lib/sql/grant-all.postgres.sql
index 427c3e8d84649f45bb77ddf16e18f6d90638e5dd..cac70a87b7719707d8fbe7add2859d6be92325ce 100644 (file)
--- a/lib/sql/grant-all.postgres.sql
+++ b/lib/sql/grant-all.postgres.sql
@@ -84,6 +84,7 @@ GRANT INSERT, SELECT, UPDATE, DELETE ON
        patchwork_series
 TO "nobody";
 GRANT SELECT ON
+       auth_user,
        patchwork_delegationrule,
        patchwork_project,
        patchwork_state,