fixing cve-2020-10187

Signed-off-by: progress <shravani.roy@progress.com>
chef · Aug 24, 2023 · dbb687d · dbb687d
1 parent a1cba10
commit dbb687d
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/omnibus/files/server-ctl-cookbooks/infra-server/resources/oc_id_application.rb b/omnibus/files/server-ctl-cookbooks/infra-server/resources/oc_id_application.rb
@@ -49,7 +49,7 @@ def create!
                       rails_script = <<~EOF
                               app = Doorkeeper::Application.find_or_create_by(:name => "#{new_resource.name}");
                               app.update(:redirect_uri => "#{new_resource.redirect_uri}");
-                              puts app.to_json
+                              puts app.attributes.to_json
                             EOF
                       # in order to account for rails logging, we take only the last line of output
                       # from the rails runner script. if the logging is parsed as json, we end up

diff --git a/src/chef-server-ctl/plugins/oc_id_show_app.rb b/src/chef-server-ctl/plugins/oc_id_show_app.rb
@@ -10,7 +10,7 @@
 
   rails_script = <<EOF
 app = Doorkeeper::Application.find_by(:name => "#{app_name}");
-puts app.to_json
+puts app.attributes.to_json
 EOF
 
   env_helper = "veil-env-helper --use-file -f /etc/#{ChefUtils::Dist::Org::LEGACY_CONF_DIR}/private-#{ChefUtils::Dist::Infra::SHORT}-secrets.json -s chef-server.webui_key -s oc_id.sql_password -s oc_id.secret_key_base"