Merge branch '19388-activity-logs'

closes #19388

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --git a/doc/admin/upgrading.html.textile.liquid b/doc/admin/upgrading.html.textile.liquid
index b034ba35d8a2306fc792f3eea5edd13d777c619e..7ee8fbb08ade7190f9121a88add620c64a31838c 100644 (file)
--- a/doc/admin/upgrading.html.textile.liquid
+++ b/doc/admin/upgrading.html.textile.liquid
@@ -28,9 +28,10 @@ TODO: extract this information based on git commit messages and generate changel
 <div class="releasenotes">
 </notextile>
 
-h2(#main). development main (as of 2022-08-09)
 
-"previous: Upgrading to 2.4.2":#v2_4_2
+h2(#main). development main (as of 2022-09-21)
+
+"previous: Upgrading to 2.4.3":#v2_4_3
 
 h3. Renamed keep-web metrics and WebDAV configs
 
@@ -38,6 +39,22 @@ Metrics previously reported by keep-web (@arvados_keepweb_collectioncache_reques
 
 The config entries @Collections.WebDAVCache.UUIDTTL@, @...MaxCollectionEntries@, and @...MaxUUIDEntries@ are no longer used, and should be removed from your config file.
 
+h2(#v2_4_3). v2.4.3 (2022-09-21)
+
+"previous: Upgrading to 2.4.2":#v2_4_2
+
+h3. Fixed PAM authentication security vulnerability
+
+In Arvados 2.4.2 and earlier, when using PAM authentication, if a user
+presented valid credentials but the account is disabled or otherwise
+not allowed to access the host, it would still be accepted for access
+to Arvados.  From 2.4.3 onwards, Arvados now also checks that the
+account is permitted to access the host before completing the PAM login
+process.
+
+Other authentication methods (LDAP, OpenID Connect) are not affected
+by this flaw.
+
 h2(#v2_4_2). v2.4.2 (2022-08-09)
 
 "previous: Upgrading to 2.4.1":#v2_4_1

diff --git a/sdk/ruby/lib/arvados.rb b/sdk/ruby/lib/arvados.rb
index a72a9f8241f442f20d6c7559baedeb79582cc218..7b99ba5788943581b4c0a2da469ebd60f32a1c03 100644 (file)
--- a/sdk/ruby/lib/arvados.rb
+++ b/sdk/ruby/lib/arvados.rb
@@ -7,6 +7,7 @@ require 'active_support/inflector'
 require 'json'
 require 'fileutils'
 require 'andand'
+require 'net/http'
 
 require 'arvados/google_api_client'
 
@@ -188,6 +189,15 @@ class Arvados
     @config = config
   end
 
+  def cluster_config
+    return @cluster_config if @cluster_config
+
+    uri = URI("https://#{config()["ARVADOS_API_HOST"]}/arvados/v1/config")
+    cc = JSON.parse(Net::HTTP.get(uri))
+
+    @cluster_config = cc
+  end
+
   class Model
     def self.arvados_api
       arvados.arvados_api