medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest

This commit is contained in:
jamesread 2026-03-05 00:04:58 +00:00
parent 235493e471
commit cb46a597b2
1 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
service/internal/api/api.go
View File

@ -1271,8 +1271,6 @@ func (api *oliveTinAPI) RestartAction(ctx ctx.Context, req *connect.Request[apiv
ExecutionTrackingId: req.Msg.ExecutionTrackingId,
}
var execReqLogEntry *executor.InternalLogEntry
execReqLogEntry, found := api.executor.GetLog(req.Msg.ExecutionTrackingId)
if !found {
@ -1289,12 +1287,21 @@ func (api *oliveTinAPI) RestartAction(ctx ctx.Context, req *connect.Request[apiv
return connect.NewResponse(ret), nil
}
return api.StartAction(ctx, &connect.Request[apiv1.StartActionRequest]{
Msg: &apiv1.StartActionRequest{
BindingId: execReqLogEntry.GetBindingId(),
UniqueTrackingId: req.Msg.ExecutionTrackingId,
},
})
authenticatedUser := auth.UserFromApiCall(ctx, req, api.cfg)
// TrackingID is deliberately not passed to the executor, so that it generates a new one for the restarted execution.
// This is because the old execution (identified by the old TrackingID) is already used.
execReq := executor.ExecutionRequest{
Binding: execReqLogEntry.Binding,
Arguments: make(map[string]string),
AuthenticatedUser: authenticatedUser,
Cfg: api.cfg,
}
api.executor.ExecRequest(&execReq)
ret.ExecutionTrackingId = execReq.TrackingID
return connect.NewResponse(ret), nil
}
func newServer(ex *executor.Executor) *oliveTinAPI {