-
Bug
-
Resolution: Fixed
-
Low
-
4.8.0, 5.0.0, 6.1.0, 5.16.7, 6.4.1
-
1
-
Severity 2 - Major
-
17
-
Issue Summary
If once licensed users have an SSH key added to their profile, it is still possible for them to push the code once the license had been removed. However, it is not possible to pull the code.
Environment
Every environment.
Steps to Reproduce
- Create a new user.
- Add any Global Permission to the user granting write access to a repository.
- Add an SSH key to users' profile.
- Clone a repository over SSH with that user.
- Push and pull some code.
- Remove the Global permission from the user so it becomes unlicensed.
- Try to pull the code
- no permission - Add some files.
- Try to push the code
- successful
Expected Results
Ad 7. Try to pull the code - no access to the repo. The code can't be pulled, as the user is not licensed. - working as expected
Ad 9. Try to push the code - no access to the repo. The code shouldn't be pushed, as the user is not licensed. - does not work as expected
Actual Results
Ad 7. Try to pull the code - no access to the repo. The code can't be pulled, as the user is not licensed.
Ad 9. # Try to push the code - it is possible to push the code with an unlicensed user over SSH.
Git Pull with unlicensed user:
C02V50FZHTD8:prtest_ssh ttokarczuk$ git pull
fatal: remote error: Unlicensed user
You do not have permission to access Bitbucket. Please ask an administrator to
grant you access.
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Access log:
0:0:0:0:0:0:0:1 | ssh | i@1LCYOVQx1120x3279x0 | newuser1 | 2019-07-26 18:40:19,734 | SSH - git-upload-pack '/pul/prtest.git' | "SSH-2.0-OpenSSH_7.9" | - | - | - | - | - | zsndkq | 0:0:0:0:0:0:0:1 | ssh | o@1LCYOVQx1120x3279x0 | newuser1 | 2019-07-26 18:40:19,741 | SSH - git-upload-pack '/pul/prtest.git' | "SSH-2.0-OpenSSH_7.9" | 1 | 0 | 0 | ssh:user:id:52 | 7 | zsndkq |
Adding a new file and pushing it with unlicensed user:
C02V50FZHTD8:prtest_ssh ttokarczuk$ touch push_without_a_license C02V50FZHTD8:prtest_ssh ttokarczuk$ git add . C02V50FZHTD8:prtest_ssh ttokarczuk$ git commit -m "Push without a license" [master a91db00] Push without a license 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 push_without_a_license C02V50FZHTD8:prtest_ssh ttokarczuk$ git push Enumerating objects: 3, done. Counting objects: 100% (3/3), done. Delta compression using up to 8 threads Compressing objects: 100% (2/2), done. Writing objects: 100% (2/2), 263 bytes | 263.00 KiB/s, done. Total 2 (delta 1), reused 0 (delta 0) To ssh://localhost:5640/pul/prtest.git 4802e97..a91db00 master -> master
Access log:
0:0:0:0:0:0:0:1 | ssh | i@1LCYOVQx1120x3280x0 | newuser1 | 2019-07-26 18:40:49,809 | SSH - git-receive-pack '/pul/prtest.git' | "SSH-2.0-OpenSSH_7.9" | - | - | - | - | - | biziit | 0:0:0:0:0:0:0:1 | ssh | o@1LCYOVQx1120x3280x0 | newuser1 | 2019-07-26 18:40:50,188 | SSH - git-receive-pack '/pul/prtest.git' | "SSH-2.0-OpenSSH_7.9" | 0 | 373 | 882 | protocol:1, push, ssh:user:id:52 | 379 | biziit |
Notes
Tested in Bitbucket 6.1.x and 6.4.1
Workaround
Currently, there is no known workaround, as removing SSH access completely doesn't seem to be feasible.