medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge commit from fork 

security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest
This commit is contained in:
James Read 2026-03-04 19:05:48 -05:00 committed by GitHub
parent 32c7fd73b8 cb46a597b2
commit 6202736d53
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
service/internal/api/api.go
View File

@ -1273,8 +1273,6 @@ func (api *oliveTinAPI) RestartAction(ctx ctx.Context, req *connect.Request[apiv
ExecutionTrackingId: req.Msg.ExecutionTrackingId, ExecutionTrackingId: req.Msg.ExecutionTrackingId,
} }
var execReqLogEntry *executor.InternalLogEntry
execReqLogEntry, found := api.executor.GetLog(req.Msg.ExecutionTrackingId) execReqLogEntry, found := api.executor.GetLog(req.Msg.ExecutionTrackingId)
if !found { if !found {
@ -1291,12 +1289,21 @@ func (api *oliveTinAPI) RestartAction(ctx ctx.Context, req *connect.Request[apiv
return connect.NewResponse(ret), nil return connect.NewResponse(ret), nil
} }
return api.StartAction(ctx, &connect.Request[apiv1.StartActionRequest]{ authenticatedUser := auth.UserFromApiCall(ctx, req, api.cfg)
Msg: &apiv1.StartActionRequest{
BindingId: execReqLogEntry.GetBindingId(), // TrackingID is deliberately not passed to the executor, so that it generates a new one for the restarted execution.
UniqueTrackingId: req.Msg.ExecutionTrackingId, // This is because the old execution (identified by the old TrackingID) is already used.
}, execReq := executor.ExecutionRequest{
}) Binding: execReqLogEntry.Binding,
Arguments: make(map[string]string),
AuthenticatedUser: authenticatedUser,
Cfg: api.cfg,
}
api.executor.ExecRequest(&execReq)
ret.ExecutionTrackingId = execReq.TrackingID
return connect.NewResponse(ret), nil
} }
func newServer(ex *executor.Executor) *oliveTinAPI { func newServer(ex *executor.Executor) *oliveTinAPI {