buildkite / feedback

Got feedback? Please let us know!
https://buildkite.com
25 stars 24 forks source link

Infinite redirects when lacking viewing permission #509

Closed umamaistempo closed 5 years ago

umamaistempo commented 5 years ago

Just joined my team's buildkite. The home page says:

You don’t have permission to view or create any pipelines because you’ve not been assigned to a team.

Please contact one of your team maintainers or organization administrators for help.

If I try to open a build (this was my entrypoint to buildkite) or any other company-owned page, I get redirected to the same location infinitely (because I do not have access to the page but the location header being returned is the current page).

Eg:

GET https://buildkite.com/COMPANY/PIPELINE/builds/33095

HTTP/2.0 301 Moved Permanently
date: Mon, 03 Jun 2019 12:44:27 GMT
content-type: text/html; charset=utf-8
location: https://buildkite.com/REDACTED/REDACTED/builds/33095
server: nginx
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
cache-control: no-cache, no-store
content-security-policy-report-only: object-src 'none'; script-src 'unsafe-inline' 'strict-dynamic' 'report-sample' https: http: REDACTED; report-uri /_csp-violation-reports
set-cookie: _buildkite_sess=REDACTED; secure; HttpOnly
x-request-id: REDACTED
x-runtime: 0.027087
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
x-ua-compatible: chrome=1
X-Firefox-Spdy: h2

As you can see, the location header is the same endpoint I'm trying to access but lacking permission

ticky commented 5 years ago

Hi @umamaistempo, that's a weird one - if it's still happening, would you mind sending the full link you're trying to access, and the email address of your account, to support@buildkite.com and we can check things out!

keithpitt commented 5 years ago

Ah ha! Found the bug!

Can you try again @umamaistempo and confirm it's no longer happening?

umamaistempo commented 5 years ago

Seems fine, now I'm getting a proper 404 :grinning: Thank you