Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Validate galley IDs against submissions #8299

Closed
NateWr opened this issue Sep 29, 2022 · 3 comments
Closed

Validate galley IDs against submissions #8299

NateWr opened this issue Sep 29, 2022 · 3 comments
Assignees
@NateWr
Labels
Housekeeping:1:Todo Any dependency management or refactor that would be nice to have some day.
Milestone
3.3.0-13

Comments

@NateWr
Copy link
Member

NateWr commented Sep 29, 2022 •
edited by asmecher

Describe the bug
The galley grids often use the requested galley id without checking it against the authorized objects.

To Reproduce
Reproduction steps will be withheld until a secure release has been made.

What application are you using?
Affects OJS and OPS 3.3.

Resolution

We recommend one of the following approaches to resolve this issue.

1. Download and upgrade

Upgrade to OJS 3.3.0-13 or OPS 3.3.0-13 or a newer version.

2. Using Git

If you are running your application off of a git repository, you can pull the commits into your repo.

Update the Stable Branch

If you are running your application off of the official stable-3_3_0 branch, please pull the latest commits into your repo in the root directory as well as the submodule at lib/pkp.

Cherry-pick to a Fork

If you are running your application off of a forked version of our software, please follow these steps to cherry-pick the changes into your fork of our stable-3_3_0 branch:

For OJS:

  • git cherry-pick 342d655
  • cd lib/pkp
  • git cherry-pick 9c997a8

For OPS:

  • git cherry-pick 25c4c66
  • cd lib/pkp
  • git cherry-pick 9c997a8

3. Using Patches

If you have installed OJS or OPS 3.3.0-13, you can can manually patch the files on your server by running these commands.

For OJS:

  • First check if the patches will apply cleanly:
    • cd [path to OJS]
    • wget -O - -q https://github.com/pkp/ojs/commit/342d655.diff | patch -p1 --dry-run
    • cd lib/pkp
    • wget -O - -q https://github.com/pkp/pkp-lib/commit/9c997a8.diff | patch -p1 --dry-run
    • cd ../..
  • If there are no problems, run the following to apply the patches:
    • wget -O - -q https://github.com/pkp/ojs/commit/342d655.diff | patch -p1
    • cd lib/pkp
    • wget -O - -q https://github.com/pkp/pkp-lib/commit/9c997a8.diff | patch -p1

For OPS:

  • First check if the patches will apply cleanly:
    • cd [path to OPS]
    • wget -O - -q https://github.com/pkp/ojs/commit/25c4c66.diff | patch -p1 --dry-run
    • cd lib/pkp
    • wget -O - -q https://github.com/pkp/pkp-lib/commit/9c997a8.diff | patch -p1 --dry-run
    • cd ../..
  • If there are no problems, run the following to apply the patches:
    • wget -O - -q https://github.com/pkp/ojs/commit/25c4c66.diff | patch -p1
    • cd lib/pkp
    • wget -O - -q https://github.com/pkp/pkp-lib/commit/9c997a8.diff | patch -p1
@NateWr NateWr added the Housekeeping:1:Todo Any dependency management or refactor that would be nice to have some day. label Sep 29, 2022
@NateWr NateWr self-assigned this Sep 29, 2022
@NateWr NateWr added this to the 3.3.0-13 milestone Sep 29, 2022
NateWr added a commit to NateWr/ojs that referenced this issue Sep 29, 2022
@NateWr
pkp/pkp-lib#8299 Get galley from helper method
e112529
NateWr added a commit to NateWr/pkp-lib that referenced this issue Sep 29, 2022
@NateWr
pkp#8299 Fix representation policy
b5f80d4
NateWr added a commit to NateWr/ojs that referenced this issue Sep 29, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
6bc25e3
NateWr added a commit to NateWr/ops that referenced this issue Sep 29, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
25c4c66
NateWr added a commit to NateWr/pkp-lib that referenced this issue Sep 29, 2022
@NateWr
pkp#8299 Fix galley grid
7582c64
NateWr added a commit to NateWr/ojs that referenced this issue Sep 29, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
89de0e2
NateWr added a commit to NateWr/ojs that referenced this issue Sep 29, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
2be0105
NateWr added a commit to NateWr/ops that referenced this issue Sep 29, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
f7626af
@NateWr
Copy link
Member Author

NateWr commented Sep 29, 2022 •
edited

PRs for stable-3_3_0:
#8300
pkp/ojs#3558
pkp/ops#360

PRs for main:
#8301
pkp/ojs#3559
pkp/ops#361

@asmecher
Copy link
Member

asmecher commented Oct 3, 2022

Thanks, @NateWr, looks good -- please go ahead and merge. I'll try to get 3.3.0-13 released tomorrow if this is ready to be included.

@asmecher asmecher modified the milestones: 3.3.0-14, 3.3.0-13 Oct 3, 2022
NateWr added a commit to NateWr/pkp-lib that referenced this issue Oct 4, 2022
@NateWr
pkp#8299 Fix representation policy
9c997a8
NateWr added a commit to NateWr/ojs that referenced this issue Oct 4, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
342d655
NateWr added a commit that referenced this issue Oct 4, 2022
@NateWr
Merge pull request #8300 from NateWr/i8299_galley_grid
4803e47 
#8299 Fix representation policy
NateWr added a commit to pkp/ojs that referenced this issue Oct 4, 2022
@NateWr
Merge pull request #3558 from NateWr/i8299_galley_grid
cc97356 
pkp/pkp-lib#8299 Get galley from helper method
NateWr added a commit to pkp/ops that referenced this issue Oct 4, 2022
@NateWr
Merge pull request #360 from NateWr/i8299_galley_grid
4644649 
pkp/pkp-lib#8299 Fix galley grid
NateWr added a commit to NateWr/pkp-lib that referenced this issue Oct 4, 2022
@NateWr
pkp#8299 Fix galley grid
25e0b00
NateWr added a commit to NateWr/ojs that referenced this issue Oct 4, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
4774c5f
NateWr added a commit to NateWr/ops that referenced this issue Oct 4, 2022
@NateWr
pkp/pkp-lib#8299 Fix galley grid
4189260
NateWr added a commit that referenced this issue Oct 4, 2022
@NateWr
Merge pull request #8301 from NateWr/i8299_galley_grid_main
c22797e 
#8299 Fix galley grid
NateWr added a commit to pkp/ojs that referenced this issue Oct 4, 2022
@NateWr
Merge pull request #3559 from NateWr/i8299_galley_grid_main
662bd6c 
pkp/pkp-lib#8299 Fix galley grid
NateWr added a commit to pkp/ops that referenced this issue Oct 4, 2022
@NateWr
Merge pull request #361 from NateWr/i8299_galley_grid_main
9b6f518 
pkp/pkp-lib#8299 Fix galley grid
@NateWr
Copy link
Member Author

NateWr commented Oct 4, 2022

All merged to stable-3_3_0 and main.

@NateWr NateWr closed this as completed Oct 4, 2022
@NateWr NateWr changed the title Use helper method in galley grids Validate galley IDs against submissions Oct 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@NateWr NateWr

Labels
Housekeeping:1:Todo Any dependency management or refactor that would be nice to have some day.
Projects
Editorial Workflow
Status: Done
Milestone
3.3.0-13
Development

No branches or pull requests
2 participants
@asmecher @NateWr