Create Private Repo creates public repository

[jongalloway]

This blog post says that the author checked the "Create Private Repo" checkbox, but a public repository was created and the author inadvertently published AWS keys: How a bug in Visual Studio 2015 exposed my source code on GitHub and cost me $6,500 in a few hours

I'm fairly certain this is an issue in the GitHub extension, rather than Visual Studio itself.

Here's how the Visual Studio sync dialog appears without the GitHub extension installed:

And with the extension:

[gaui]

👍

[shiftkey]

cc @thecarlo

[NickCraver]

I have just signed up for private repros and I can reproduce this, specifically from the Team Explorer -> Sync route. The other route of creating a repo correctly sets it as private.

[shiftkey]

@NickCraver thanks for the repro steps. I'm looking at this now to see if I can organize a fix.

[shiftkey]

I've also been able to recreate this. Talking with @haacked about how to solve this, but will open something soon with details.

[ghuntley]

Reddit discussion over at https://www.reddit.com/r/programming/comments/3j4ydl/how_a_bug_in_visual_studio_2015_exposed_my_source/

[shiftkey]

The updated build has landed on the gallery - https://visualstudiogallery.msdn.microsoft.com/75be44fb-0794-4391-8865-c3279527e97d.

[haacked]

First of all, I'm very sorry for this bug. It's inexcusable and I feel horrible.

As @shiftkey points out, we updated the extension with a fix on the Visual Studio Gallery and at https://visualstudio.github.com/.

The problem only affected publishing repositories, not in creating repositories which used pretty much the same code, but in a slightly different context.

You can see the fix in this PR: #64

Based on our preliminary investigation, checkboxes in a Team Explorer pane appear to behave differently than checkboxes in a standard WPF control. We're not sure why that is and we'll continue to investigate.

Once we have a root cause down, we'll post a post-mortem somewhere appropriate.

[niik]

We've deployed a change to the GitHub.com API that prevents new public repositories from being created by versions of the Visual Studio extension prior to 1.0.14.

Old versions of the extension will show an error message requesting users to update their extension along with an explanation on how to do so.

[shana]

This is the latest version of the message.

[NickCraver]

Kudos on getting multiple fixes out immediately after this came to light. The active blocking on older versions is a nice touch and absolutely the right call, good job all around.

I really do look forward to seeing why this doesn't behave correctly on the bindings as soon as it's figured out. I had it up in a debugger last night and couldn't figure out why the binding was failing only here either - good luck tracking it down.

[phillip-haydon]

That's a nice solution, to block the API for the old version. Well done!

[thecarlo]

Kudos on getting multiple fixes out immediately after this came to light. The active blocking on older versions is a nice touch and absolutely the right call, good job all around.

Yes well done guys for jumping on this so quick.