2022-05-23 - Monday
Tasks
DONE One-on-onew with Andrii
CLOSED:
:LOGBOOK:
CLOCK: -- => 0:30
:END:
DONE Figure out Sev1 issue with Moderna data access
CLOSED:
- Note taken on
Fuck this is exhausting. At first blush folks thought this was similar to the
BSR data leak that was created by [[file:../pages/fifteenfive_project_role_based_access_control.org][FifteenFive Project: Role Based Access
Control]] but upon closer reflection, [[id:a6c99b1d-518b-45c4-a8b8-766a44d8b788][Marko Romanko]] had recently pushed a commit
that added full report download. After doing some sleuthing around in various
places and having a really hard time reproducing the bug, I noticed that when
you generated reporters for the User in question using common helper function
it returned None. This turned out to be the smoking gun, as some of Marko's
new code add a catch-all statement for report downloads within BSR where if
the manager's reviewers are empty, we just let them download the whole
company. Bartek is working on a fix as we speak.
:LOGBOOK:
CLOCK: -- => 0:25
CLOCK: -- => 3:20
:END:
DONE Review pull request from Bartek
CLOSED:
DONE RevUP meeting
CLOSED:
DONE Hike with the family
CLOSED: