Open wilsoc5 opened 8 years ago
Thanks for filing the report. I can't reproduce this behavior with:
gnupg 1.4.18
ruby 2.1.5p273
rails 4.2.7.1
redmine 3.1.7 / 3.2.5 / 3.3.2
gpgme 2.0.12
mail-gpg 0.3.0
openpgp branch/develop
Also another environment with Rails 4.2.3 is missing those symptoms, and without a deeper look I suspect Rails to be the cause for it.
What causes this message exactly? The context suggests, you tried to save a public pgp key as a normal user.
As I understand, your solution would be less secure without further checks on the user input, so I won't include it without.
On the other hand you might consider to upgrade redmine, as your version is quite old and possibly insecure (see Security Advisories).
I'm getting a mass-assignment warning on version 1.0. log file:
Looking at the pgpkeys database table, only NULLs are inserted for user_id, fpr, and secret. Reloading the page for a user results in no key apparently loaded even though the flash showed success. Looking at the GPG key chain, shows the user key in there.
Updating models/pgpkey.rb to:
solves the problem and loads the database appropriately.