Issue #8816: Syncing a repo with sles_auth_token set on the remote, may try to download kickstart files incorrectly - RPM Support - Pulp

Actions

Send by e-mail Copy link

Issue #8816

closed

Syncing a repo with sles_auth_token set on the remote, may try to download kickstart files incorrectly

Added by jsherril@redhat.com over 3 years ago. Updated over 3 years ago.

Status:

CLOSED - CURRENTRELEASE

Priority:

Normal

Assignee:

dalley

Sprint/Milestone:

3.13.0

Start date:

Due date:

Estimated time:

Severity:

2. Medium

Version:

Platform Release:

OS:

Triaged:

Yes

Groomed:

Sprint Candidate:

Tags:

Katello

Sprint:

Quarter:

Description

If you try to sync: http://distro.ibiblio.org/centos/7.9.2009/os/x86_64/

with the sles_auth_token set to: foo=bar (or any param/value). The Sync will fail with:

403, message='Forbidden', url=URL('http://distro.ibiblio.org/centos/7.9.2009/os/x86_64/LiveOS/squashfs.img/?foo=bar')

Notice that an extra slash is added to the url, it likely should be: http://distro.ibiblio.org/centos/7.9.2009/os/x86_64/LiveOS/squashfs.img?foo=bar

Note that this repo is not actually a SLES repo, and this was discovered accidentally due to katello's aggressive nature of using the sles_auth_token for all get params on a repo, but this will also be tackled (https://projects.theforeman.org/issues/32660)

Actions

Copy link

Updated by jsherril@redhat.com over 3 years ago

Description updated (diff)

Actions

Copy link

Updated by dalley over 3 years ago

@Justin, is this an issue that impacts all SLES repos, or an issue that occurs because this option was used on a non-SLES repo?

Actions

Copy link

Updated by jsherril@redhat.com over 3 years ago

its mostly because it was used on a non-sles repo, but i suspect it could happen on a sles repo if it includes kickstart files. It may return a 404 instead of a 403 depending on the webserver in use

Actions

Copy link