From 021c4b51ef3eb3f8bf8a217234333e882a5a9576 Mon Sep 17 00:00:00 2001 From: amangalampalli-ks Date: Fri, 26 Jun 2026 19:34:01 +0530 Subject: [PATCH 1/2] Flag rotation script uploads with is_script for owner-only server enforcement --- keepercommander/attachment.py | 12 +++++++++--- keepercommander/commands/discoveryrotation.py | 2 +- keepercommander/commands/discoveryrotation_v1.py | 2 +- keepercommander/commands/pam_import/base.py | 2 +- 4 files changed, 12 insertions(+), 6 deletions(-) diff --git a/keepercommander/attachment.py b/keepercommander/attachment.py index c2cd95803..7da4206b5 100644 --- a/keepercommander/attachment.py +++ b/keepercommander/attachment.py @@ -129,6 +129,7 @@ def __init__(self): self.name = '' self.title = '' self.thumbnail = None # type: Optional[bytes] + self.is_script = False def prepare(self): pass @@ -150,10 +151,11 @@ def open(self): class FileUploadTask(UploadTask): - def __init__(self, file_path): + def __init__(self, file_path, is_script=False): super().__init__() self.file_path = file_path self.name = os.path.basename(self.file_path) + self.is_script = is_script def prepare(self): self.file_path = os.path.expanduser(self.file_path) @@ -247,6 +249,7 @@ def upload_attachments(params, record, attachments): file.record_uid = file_uid file.record_key = crypto.encrypt_aes_v2(file_key, params.data_key) file.fileSize = task.size + 100 + file.is_script = task.is_script file_data = { 'title': task.title or task.name, 'name': task.name or '', @@ -267,6 +270,9 @@ def upload_attachments(params, record, attachments): file_uid = uo.record_uid task = file_tasks[file_uid] if uo.status != record_pb2.FA_SUCCESS: + if task.is_script: + raise Exception( + f'Uploading rotation script {task.name}: only the record owner can attach post-rotation scripts.') raise Exception(f'Uploading file {task.name}: Get upload URL error.') file_key = file_keys[file_uid] @@ -278,7 +284,7 @@ def upload_attachments(params, record, attachments): } response = requests.post(uo.url, files=files, data=json.loads(uo.parameters), proxies=params.rest_context.proxies, - verify=params.rest_context.certificate_check) + verify=params.ssl_verify) if response.status_code == uo.success_status_code: facade.file_ref.append(file_ref) if record.linked_keys is None: @@ -295,7 +301,7 @@ def upload_attachments(params, record, attachments): } requests.post(uo.url, files=files, data=json.loads(uo.thumbnail_parameters), proxies=params.rest_context.proxies, - verify=params.rest_context.certificate_check) + verify=params.ssl_verify) except Exception as e: logging.warning('Error uploading thumbnail: %s', e) else: diff --git a/keepercommander/commands/discoveryrotation.py b/keepercommander/commands/discoveryrotation.py index 8d36c5eb6..60e3ad13a 100644 --- a/keepercommander/commands/discoveryrotation.py +++ b/keepercommander/commands/discoveryrotation.py @@ -3050,7 +3050,7 @@ def execute(self, params, **kwargs): facade = record_facades.FileRefRecordFacade() facade.record = record pre = set(facade.file_ref) - upload_task = attachment.FileUploadTask(full_name) + upload_task = attachment.FileUploadTask(full_name, is_script=True) attachment.upload_attachments(params, record, [upload_task]) post = set(facade.file_ref) df = post.difference(pre) diff --git a/keepercommander/commands/discoveryrotation_v1.py b/keepercommander/commands/discoveryrotation_v1.py index a754b39de..d25e0d4b6 100644 --- a/keepercommander/commands/discoveryrotation_v1.py +++ b/keepercommander/commands/discoveryrotation_v1.py @@ -1355,7 +1355,7 @@ def execute(self, params, **kwargs): facade = record_facades.FileRefRecordFacade() facade.record = record pre = set(facade.file_ref) - upload_task = attachment.FileUploadTask(full_name) + upload_task = attachment.FileUploadTask(full_name, is_script=True) attachment.upload_attachments(params, record, [upload_task]) post = set(facade.file_ref) df = post.difference(pre) diff --git a/keepercommander/commands/pam_import/base.py b/keepercommander/commands/pam_import/base.py index ef2b6dabc..c98a86221 100644 --- a/keepercommander/commands/pam_import/base.py +++ b/keepercommander/commands/pam_import/base.py @@ -3695,7 +3695,7 @@ def add_pam_scripts(params, record, scripts): facade = record_facades.FileRefRecordFacade() facade.record = rec pre = set(facade.file_ref) - upload_task = attachment.FileUploadTask(full_name) + upload_task = attachment.FileUploadTask(full_name, is_script=True) attachment.upload_attachments(params, rec, [upload_task]) post = set(facade.file_ref) df = post.difference(pre) From 1084a754e16bc7e16f0286e666e7a986efbb134d Mon Sep 17 00:00:00 2001 From: amangalampalli-ks Date: Fri, 26 Jun 2026 19:57:08 +0530 Subject: [PATCH 2/2] Undo ssl changes --- keepercommander/attachment.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/keepercommander/attachment.py b/keepercommander/attachment.py index 7da4206b5..03d372c8e 100644 --- a/keepercommander/attachment.py +++ b/keepercommander/attachment.py @@ -284,7 +284,7 @@ def upload_attachments(params, record, attachments): } response = requests.post(uo.url, files=files, data=json.loads(uo.parameters), proxies=params.rest_context.proxies, - verify=params.ssl_verify) + verify=params.rest_context.certificate_check) if response.status_code == uo.success_status_code: facade.file_ref.append(file_ref) if record.linked_keys is None: @@ -301,7 +301,7 @@ def upload_attachments(params, record, attachments): } requests.post(uo.url, files=files, data=json.loads(uo.thumbnail_parameters), proxies=params.rest_context.proxies, - verify=params.ssl_verify) + verify=params.rest_context.certificate_check) except Exception as e: logging.warning('Error uploading thumbnail: %s', e) else: