Do not double encrypt a protected password dialog text field #18031
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eclarizio
changed the title
mkanoor
approved these changes
Sep 28, 2018
|
@lfu Please review this is needed for your BZ to prevent double encryption |
gmcculloug
reviewed
Sep 28, 2018
app/models/dialog_field_text_box.rb
Outdated
| @@ -31,7 +31,7 @@ def value_from_dialog_fields(dialog_values) | |||
|
|
|||
| def automate_output_value | |||
| return nil if @value.nil? | |||
| return MiqPassword.encrypt(@value) if self.protected? | |||
| return MiqPassword.encrypt(@value) if self.protected? && value_is_not_already_encrypted? | |||
There was a problem hiding this comment.
You should use MiqPassword.encrypted? instead of creating a new method. Also, we need to use MiqPassword methods so we are protected against the encrypted string format changing in the future.
There was a problem hiding this comment.
Oh I didn't even realize this existed, nice. Will change.
eclarizio
force-pushed
the
BZ1602883-Related
branch
from
82a28f0
to
2496b78
Compare
|
Checked commit eclarizio@2496b78 with ruby 2.3.3, rubocop 0.52.1, haml-lint 0.20.0, and yamllint 1.10.0 app/models/dialog_field_text_box.rb
|
simaishi
pushed a commit
that referenced
this pull request
Oct 1, 2018
Do not double encrypt a protected password dialog text field (cherry picked from commit 27c9fe3) https://bugzilla.redhat.com/show_bug.cgi?id=1602883
|
Hammer backport details: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When passing in an already encrypted value to a protected field in some back end methods, there was an issue where it would encrypt it again. Whoops.
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1602883
@miq-bot assign @gmcculloug
/cc @mkanoor