commit 77bc1864ea612ee09536929018afc31698a9462b
author Alice Kober-Sotzek <aliceks@google.com> Thu Jun 25 20:05:47 2020 +0200
committer Alice Kober-Sotzek <aliceks@google.com> Fri Jun 26 09:39:10 2020 +0000
tree b869bcedece0190bad32ce2ef1d8a4ac65b875a4
parent 6b2874dd1213365c26963cd2574ff7619db74bb1

GetConfig: Don't show plugin config entries to all users

The GetConfig REST endpoint exposes configuration values stored
on refs/meta/config. It is accessible by everybody who can see at least
one ref in the repository even if they don't have read access on
refs/meta/config. Originally, some fields were only filled if the
calling user had read access on refs/meta/config (I299a5317f). This was
adjusted in I37a3e3047 as all other fields at that time were considered
safe to expose. However, we added many more fields in the meantime for
which we might not have considered the necessity of an explicit
permission check.

Iab3bc2ea2 added the possibility for plugins to show and adjust their
config values on the UI. Since then, plugin owners have made use of
this extension point in good belief for any configuration options they
wanted to conveniently see/modify on the UI. What the non-existent
extension point documentation doesn't mention, though, is that none of
these configuration options are guarded by read access to
refs/meta/config. That might easily be something that plugin authors
(or admins deciding to use the plugin) might miss and be negatively
surprised about in retrospect.

Hence, we think it's best to guard the plugin config options with
read access on refs/meta/config. This stays compliant with the promises
of the GetConfig REST endpoint as we've had the sentence "Some fields
are only visible to users that have read access to refs/meta/config."
in the documentation continuously since the original change
(I299a5317f).

If we get complaints from plugin authors about the changed behavior,
we can add a way again to show the plugin config values without read
access to refs/meta/config. However, that solution should involve an
explicit acknowledgement in code that the config values should be
exposed in that way (e.g. an explicit flag with an appropriate name
needs to be set).

Change-Id: I42a78b9d7bdee66033e0c7e0cc853c4880d3f322