{"action":"created","issue":{"url":"https://api.github.com/repos/OCA/runbot-addons/issues/51","labels_url":"https://api.github.com/repos/OCA/runbot-addons/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/OCA/runbot-addons/issues/51/comments","events_url":"https://api.github.com/repos/OCA/runbot-addons/issues/51/events","html_url":"https://github.com/OCA/runbot-addons/pull/51","id":101942462,"number":51,"title":"Runbot skip test jobs","user":{"login":"lepistone","id":1314778,"avatar_url":"https://avatars.githubusercontent.com/u/1314778?v=3","gravatar_id":"","url":"https://api.github.com/users/lepistone","html_url":"https://github.com/lepistone","followers_url":"https://api.github.com/users/lepistone/followers","following_url":"https://api.github.com/users/lepistone/following{/other_user}","gists_url":"https://api.github.com/users/lepistone/gists{/gist_id}","starred_url":"https://api.github.com/users/lepistone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lepistone/subscriptions","organizations_url":"https://api.github.com/users/lepistone/orgs","repos_url":"https://api.github.com/users/lepistone/repos","events_url":"https://api.github.com/users/lepistone/events{/privacy}","received_events_url":"https://api.github.com/users/lepistone/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-08-19T16:37:39Z","updated_at":"2015-08-20T13:21:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/OCA/runbot-addons/pulls/51","html_url":"https://github.com/OCA/runbot-addons/pull/51","diff_url":"https://github.com/OCA/runbot-addons/pull/51.diff","patch_url":"https://github.com/OCA/runbot-addons/pull/51.patch"},"body":"To avoid conflicts I included #49 here. The diff will look correct here once #49 is merged. Thanks!"},"comment":{"url":"https://api.github.com/repos/OCA/runbot-addons/issues/comments/133005225","html_url":"https://github.com/OCA/runbot-addons/pull/51#issuecomment-133005225","issue_url":"https://api.github.com/repos/OCA/runbot-addons/issues/51","id":133005225,"user":{"login":"bwrsandman","id":1013356,"avatar_url":"https://avatars.githubusercontent.com/u/1013356?v=3","gravatar_id":"","url":"https://api.github.com/users/bwrsandman","html_url":"https://github.com/bwrsandman","followers_url":"https://api.github.com/users/bwrsandman/followers","following_url":"https://api.github.com/users/bwrsandman/following{/other_user}","gists_url":"https://api.github.com/users/bwrsandman/gists{/gist_id}","starred_url":"https://api.github.com/users/bwrsandman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwrsandman/subscriptions","organizations_url":"https://api.github.com/users/bwrsandman/orgs","repos_url":"https://api.github.com/users/bwrsandman/repos","events_url":"https://api.github.com/users/bwrsandman/events{/privacy}","received_events_url":"https://api.github.com/users/bwrsandman/received_events","type":"User","site_admin":false},"created_at":"2015-08-20T13:21:59Z","updated_at":"2015-08-20T13:21:59Z","body":"@nhomar anyone who can add harmful code to the build instructions needs to be either admin or part of the runbot group.\r\n\r\nOn top of that, adding bash expressions `||` for example will not work since the mechanism here is python system and those work with single commands. Python itself does the piping and the logical operations on return codes.\r\n\r\nThat's not to say the executable couldn't be changed to something harmful, but that is the same issue as with the vanilla runbot. The vanilla runbot security issue is more serious because anyone who can do a pull request can change, while this one would be limited with those who have been granted the rights.\r\n\r\nI see them as the same security issue since they're both affected by the more serious issue."}}