Actions
Issue #2520
closed
credentials in feed URL are not url-unquoted
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version:
Platform Release:
2.11.2
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Easy Fix, Pulp 2
Sprint:
Sprint 13
Quarter:
Description
This change: https://github.com/pulp/pulp/pull/2697/files#diff-ea2980a00ce94a68c6280c62d0e8b64eR57
introduced the ability to automatically parse a feed url, extract any credentials included in the URL, and add them to an importer config.
It fails to "urlunquote" the credentials, so if a user includes a url-quotable character in a credential, authentication will fail.
For example, "username:p@ssword" would appear in the URL as "username:p%40ssword". The credentials need to be passed through this function before being added to the importer config:
https://docs.python.org/2/library/urllib.html#urllib.unquote
Related issues
Actions
.
URL unquote escaped credentials in feed URL
fixes #2520 https://pulp.plan.io/issues/2520