← Back to branch summary

~ubuntu-branches/ubuntu/precise/puppet/precise-security

« back to all changes in this revision

Viewing changes to lib/puppet/indirector/file_bucket_file/selector.rb

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2012-07-10 07:58:03 UTC
  • Revision ID: package-import@ubuntu.com-20120710075803-og8iubg2a90dtk7f
Tags: 2.7.11-1ubuntu2.1
* SECURITY UPDATE: Multiple July 2012 security issues
  - debian/patches/2.7.17-Puppet-July-2012-CVE-fixes.patch: upstream
    patch to fix multiple security issues.
  - CVE-2012-3864: arbitrary file read on master from authenticated
    clients
  - CVE-2012-3865: arbitrary file delete or denial of service on master
    from authenticated clients
  - CVE-2012-3866: last_run_report.yaml report file is world readable and
    leads to arbitrary file read on master by an agent
  - CVE-2012-3867: insufficient input validation for agent cert hostnames

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/puppet/indirector/file_bucket_file/selector.rb
 
1
require 'puppet/indirector/code'
 
2
 
 
3
module Puppet::FileBucketFile
 
4
  class Selector < Puppet::Indirector::Code
 
5
    desc "Select the terminus based on the request"
 
6
 
 
7
    def select(request)
 
8
      if request.protocol == 'https'
 
9
        :rest
 
10
      else
 
11
        :file
 
12
      end
 
13
    end
 
14
 
 
15
    def get_terminus(request)
 
16
      indirection.terminus(select(request))
 
17
    end
 
18
 
 
19
    def head(request)
 
20
      get_terminus(request).head(request)
 
21
    end
 
22
 
 
23
    def find(request)
 
24
      get_terminus(request).find(request)
 
25
    end
 
26
 
 
27
    def save(request)
 
28
      get_terminus(request).save(request)
 
29
    end
 
30
 
 
31
    def search(request)
 
32
      get_terminus(request).search(request)
 
33
    end
 
34
 
 
35
    def destroy(request)
 
36
      get_terminus(request).destroy(request)
 
37
    end
 
38
 
 
39
    def authorized?(request)
 
40
      terminus = get_terminus(request)
 
41
      if terminus.respond_to?(:authorized?)
 
42
        terminus.authorized?(request)
 
43
      else
 
44
        true
 
45
      end
 
46
    end
 
47
  end
 
48
end
 
49