Hold UpdateFilter authentication state per session#6329
Merged
dkayiwa merged 1 commit intoJul 20, 2026
Conversation
UpdateFilter.authenticatedSuccessfully was an instance field on the singleton filter, so once any super user authenticated at the first step of the database-update wizard the flag stayed true for everyone. A concurrent unauthenticated request could then POST straight to the review-changes step and run the pending database updates on the strength of another user's login. Move the authenticated flag into the HttpSession so each session must authenticate for itself. The shared update-in-progress state is left global on purpose so multiple super users can still watch one running update. Updates the E2E helpers to session scope, makes resetRequest carry the session forward (a follow-up request is the same client), and adds a regression test that a second session cannot reuse another session's authentication. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #6329 +/- ##
============================================
- Coverage 59.47% 59.46% -0.02%
- Complexity 9541 9542 +1
============================================
Files 731 731
Lines 38323 38322 -1
Branches 5587 5587
============================================
- Hits 22794 22788 -6
- Misses 13489 13491 +2
- Partials 2040 2043 +3 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ibacher
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
UpdateFilter.authenticatedSuccessfullywas aprivate volatile booleaninstance field on the singleton filter. On the database-update wizard, step one sets it true after a super user authenticates, and step two (reviewchanges.vm, which launches the update) gates only onif (!authenticatedSuccessfully). Because the flag is global to the filter instance rather than per-session, once any super user authenticates, a concurrent unauthenticated request can POST directly to the review-changes step and run the pending schema updates on the strength of the other user's login.The window is narrow (only while DB updates are pending after a platform upgrade), but it is a real global-authentication-state reuse.
Fix
Store the authenticated flag in the
HttpSession(AUTHENTICATED_SUCCESSFULLYattribute) instead of on the filter instance, so each session must authenticate for itself. The shared update-in-progress state (isDatabaseUpdateInProgress,updateJob) stays global on purpose, so multiple authenticated super users can still watch a single running update.Tests
resetRequest()carry the session forward (a follow-up request represents the same client).reviewChangesPage_shouldNotReuseAnotherSessionsAuthentication: one session authenticates, a second unauthenticated session posting to review-changes is bounced back to the maintenance page. All 33 UpdateFilter tests pass.Addresses GHSA-5cxm-f3p9-h63q.