Files
gerrit/java
Han-Wen Nienhuys 9dd2768cf4 Add branch name to validCommits cache key
ReceiveCommit#validCommit runs validation of new changes received.
Some of these validations include branch permission checks. After
running the check, valid commits were cached based on ObjectID.

Since the same commit could be pushed to a multiple branches in the
same push, it might be possible to bypass permission checks using this
incorrect caching.

Change-Id: I82b012f696bc18791fb4cd62fdf863efd3f8e4a4
2018-08-07 19:50:10 +02:00
..