Merge pull request #9683 from mcalmer/issv3-fix-hostspot

sanitize the channel name
uyuni-project · Jan 24, 2025 · 9f1420e · 9f1420e
2 parents 62776b5 + 2242dc8
commit 9f1420e
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/java/code/src/com/suse/manager/webui/controllers/DownloadController.java b/java/code/src/com/suse/manager/webui/controllers/DownloadController.java
@@ -592,8 +592,9 @@ else if (!onlyChannels.contains(channel)) {
                 halt(HttpStatus.SC_BAD_REQUEST, "Token does not specify the organization");
             }
             else if (!ChannelFactory.isAccessibleBy(channel, orgId)) {
-                LOG.info("Forbidden: Token does not provide access to channel {}", channel);
-                halt(HttpStatus.SC_FORBIDDEN, "Token does not provide access to channel %s".formatted(channel));
+                String sanitChannel = StringUtil.sanitizeLogInput(channel);
+                LOG.info("Forbidden: Token does not provide access to channel {}", sanitChannel);
+                halt(HttpStatus.SC_FORBIDDEN, "Token does not provide access to channel %s".formatted(sanitChannel));
             }
         }
         catch (TokenParsingException e) {