[java-identity-provider] branch main updated: IDP-1769 Installer locks down plugin contents files and strips write access

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7a4e3c0ddf7fdcb731cee7b6a180f822c7580ddc

The following commit(s) were added to refs/heads/main by this push:
       new  7a4e3c0dd IDP-1769 Installer locks down plugin contents files and strips write access
7a4e3c0dd is described below

commit 7a4e3c0ddf7fdcb731cee7b6a180f822c7580ddc
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Mar 9 15:13:00 2021 +0000

    IDP-1769 Installer locks down plugin contents files and strips write access
    
    https://issues.shibboleth.net/jira/browse/IDP-1769
    
    Do a 644 in bith the IdP Installer and the Plugin Installer.
---
 .../src/main/java/net/shibboleth/idp/installer/V4Install.java         | 4 +++-
 .../net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java     | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
index a730bb4c9..7967a96b2 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
@@ -419,7 +419,7 @@ public class V4Install extends AbstractInitializableComponent {
                     try {
                         module.enable(moduleContext);
                     } catch (final ModuleException e) {
-                        log.error("Error {erforming initial enable on module {}", id, e);
+                        log.error("Error performing initial enable on module {}", id, e);
                         throw new BuildException(e);
                     }
                 }
@@ -498,6 +498,8 @@ public class V4Install extends AbstractInitializableComponent {
                 InstallerSupport.setMode(installerProps.getTargetDir().resolve("system"), "444", "**/*");
             }
             InstallerSupport.setMode(installerProps.getTargetDir().resolve("dist"), "444", "**/*");
+            InstallerSupport.setMode(installerProps.getTargetDir().resolve("dist").resolve("plugin-contents"),
+                    "640", "**/*");
             if (currentState.getInstalledVersion() == null) {
                 InstallerSupport.setMode(installerProps.getTargetDir().resolve("credentials"),
                         installerProps.getCredentialsKeyFileMode(), "**/*");
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
index 0688ef66a..a8398577e 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
@@ -483,6 +483,8 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
     private void saveCopiedFiles(final List<Path> copiedFiles) throws BuildException {
         try {
             final Path parent = distPath.resolve("plugin-contents");
+            // Just in case it has been deprotected
+            InstallerSupport.setMode(parent, "640", "**/*");
             Files.createDirectories(parent);
             final Properties props = new Properties(1+copiedFiles.size());
             props.setProperty("idp.plugin.version",

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.