← Back to branch summary

~ubuntu-branches/ubuntu/precise/puppet/precise-security

« back to all changes in this revision

Viewing changes to lib/puppet/indirector/file_metadata/selector.rb

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2012-07-10 07:58:03 UTC
  • Revision ID: package-import@ubuntu.com-20120710075803-og8iubg2a90dtk7f
Tags: 2.7.11-1ubuntu2.1
* SECURITY UPDATE: Multiple July 2012 security issues
  - debian/patches/2.7.17-Puppet-July-2012-CVE-fixes.patch: upstream
    patch to fix multiple security issues.
  - CVE-2012-3864: arbitrary file read on master from authenticated
    clients
  - CVE-2012-3865: arbitrary file delete or denial of service on master
    from authenticated clients
  - CVE-2012-3866: last_run_report.yaml report file is world readable and
    leads to arbitrary file read on master by an agent
  - CVE-2012-3867: insufficient input validation for agent cert hostnames

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/puppet/indirector/file_metadata/selector.rb
 
1
require 'puppet/file_serving/metadata'
 
2
require 'puppet/indirector/file_metadata'
 
3
require 'puppet/indirector/code'
 
4
require 'puppet/file_serving/terminus_selector'
 
5
 
 
6
class Puppet::Indirector::FileMetadata::Selector < Puppet::Indirector::Code
 
7
  desc "Select the terminus based on the request"
 
8
  include Puppet::FileServing::TerminusSelector
 
9
 
 
10
  def get_terminus(request)
 
11
    indirection.terminus(select(request))
 
12
  end
 
13
 
 
14
  def find(request)
 
15
    get_terminus(request).find(request)
 
16
  end
 
17
 
 
18
  def search(request)
 
19
    get_terminus(request).search(request)
 
20
  end
 
21
 
 
22
  def authorized?(request)
 
23
    terminus = get_terminus(request)
 
24
    if terminus.respond_to?(:authorized?)
 
25
      terminus.authorized?(request)
 
26
    else
 
27
      true
 
28
    end
 
29
  end
 
30
end