theforeman/foreman — pull request #274 by iNecas (2012-11-30 12:31:31+00:00)
Title: Security fix - unathenticated API calls

Not cleaning thread values after handling request allowed unauthenticated API calls. Only develop version is affected, no need for back-porting.

How to reproduce:

1. one process deployment
2. log into the web intercase
3. try some API call with invalid credentials

The fix consists of 3 commits:

1. Clear the thread values outside of handling request

Adding an around filter to clear the thread values. Without this there
is a risk that the thread value from previous request will be used in
other request, which can lead to security issues.

We clear the current user at the beginning of the request (except the
test environment, where it's being used to simulate user being logged
in). In the production, this should never happen, but it's better safe
than sorry.

2. Ignore value of User.current when authorizing

This is the very issue that cause the insecure bahaviour

3. Fix inter-test dependencies

After the thread clean-up, some tests were failing because they
implicitly expected User.current to be set. Stating the dependencies
explicitly.