New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 882504 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Sep 10
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

Dashboard - Refactor api_request_handler and split anonymous posts

Project Member Reported by simonhatch@chromium.org, Sep 10

Issue description

Right now we allow both anonymous and privileged via api_request_handler, would like to make it more explicit whether you're responding to a privileged request or not.

Will split authorizedPost into privilegedPost and unprivilegedPost().

Follow up will be to switch Pinpoint's isolate handler to fall back in unprivileged to using the whitelist
 
Project Member

Comment 1 by bugdroid1@chromium.org, Sep 10

The following revision refers to this bug:
  https://chromium.googlesource.com/catapult/+/77a15654a75378454034fc046baa061d41b0d106

commit 77a15654a75378454034fc046baa061d41b0d106
Author: Simon <simonhatch@chromium.org>
Date: Mon Sep 10 18:52:45 2018

Dashboard - Make privileged and unprivileged access explicit

Background, wanted to make pinpoint's isolate upload take either an authorized service account or
fall back to the ip whitelisting. Could probably have fit that in but realized the existing
name "AuthorizedPost" might be misleading, and some endpoints do look like they were allowing
anybody with an oauth token (like add_histograms), regardless if they're internal or not.

Bug:  chromium:882504 
Change-Id: I5bb2038dea01fac325b9bf755afdf804e41d106d
Reviewed-on: https://chromium-review.googlesource.com/1217262
Reviewed-by: Ben Hayden <benjhayden@chromium.org>
Reviewed-by: Ethan Kuefner <eakuefner@chromium.org>
Commit-Queue: Simon Hatch <simonhatch@chromium.org>

[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/timeseries2.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/test_suites.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/timeseries.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/pinpoint/handlers/new_test.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/report_names.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/report_template.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/describe.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/list_timeseries.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/api_request_handler.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/add_histograms.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/api_request_handler_test.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/alerts.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/bugs.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/report_template_test.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/pinpoint/handlers/new.py
[modify] https://crrev.com/77a15654a75378454034fc046baa061d41b0d106/dashboard/dashboard/api/report_generate.py

Owner: simonhatch@chromium.org
Status: Fixed (was: Untriaged)
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 10

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/733447a48315ad0191720f2f382204024964f6ee

commit 733447a48315ad0191720f2f382204024964f6ee
Author: catapult-chromium-autoroll <catapult-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Mon Sep 10 19:58:18 2018

Roll src/third_party/catapult 0c8cc6141c62..77a15654a753 (2 commits)

https://chromium.googlesource.com/catapult.git/+log/0c8cc6141c62..77a15654a753


git log 0c8cc6141c62..77a15654a753 --date=short --no-merges --format='%ad %ae %s'
2018-09-10 simonhatch@chromium.org Dashboard - Make privileged and unprivileged access explicit
2018-09-10 jbudorick@chromium.org devil: remove references to chromium-side .gni.


Created with:
  gclient setdep -r src/third_party/catapult@77a15654a753

The AutoRoll server is located here: https://autoroll.skia.org/r/catapult-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel

BUG= chromium:882504 , chromium:881910 
TBR=sullivan@chromium.org

Change-Id: I8dc56fda01b40bf75918241eb39845a1c2a28d3b
Reviewed-on: https://chromium-review.googlesource.com/1216866
Reviewed-by: catapult-chromium-autoroll <catapult-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: catapult-chromium-autoroll <catapult-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#590030}
[modify] https://crrev.com/733447a48315ad0191720f2f382204024964f6ee/DEPS

Sign in to add a comment