Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

server: do not return inaccessible entity details to normal users #5827

Merged
merged 1 commit into from Jan 6, 2022

Conversation

shwstppr
Copy link
Contributor

@shwstppr shwstppr commented Jan 6, 2022

Description

Fixes #5534

As pre 3.x APIs allow using internal DB IDs, even normal users can use internal IDs.
This fix removes additional information in error message when the caller doesn't have access to the resource.

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

Screenshots (if appropriate):

How Has This Been Tested?

Before

(local) 馃悿 > list accounts id=2
馃檲 Error: (HTTP 531, error code 4365) Acct[c6de2628-5a8e-4d68-a95d-2f407db1612d-user] -- Account {"id": 4, "name": "user", "uuid": "c6de2628-5a8e-4d68-a95d-2f407db1612d"} does not have permission to operate with resource Acct[54e1efd3-6951-11ec-919d-645d8651f45a-admin] -- Account {"id": 2, "name": "admin", "uuid": "54e1efd3-6951-11ec-919d-645d8651f45a"}

After

(local) 馃惉 > list accounts id=2
馃檲 Error: (HTTP 531, error code 4365) Acct[c6de2628-5a8e-4d68-a95d-2f407db1612d-user] -- Account {"id": 4, "name": "user", "uuid": "c6de2628-5a8e-4d68-a95d-2f407db1612d"} does not have permission to operate with resource

Fixes apache#5534

As pre 3.x APIs allow using internal DB IDs, even normal users can use internal IDs.
This fix removes additional information in error message when the caller doesn't have access to the resource.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Copy link
Member

@rohityadavcloud rohityadavcloud left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Refactoring LGTM

@rohityadavcloud rohityadavcloud added this to the 4.16.1.0 milestone Jan 6, 2022
Copy link
Contributor

@sureshanaparti sureshanaparti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sureshanaparti
Copy link
Contributor

@blueorangutan package

@blueorangutan
Copy link

@sureshanaparti a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

Copy link
Member

@weizhouapache weizhouapache left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code LGTM

@weizhouapache weizhouapache linked an issue Jan 6, 2022 that may be closed by this pull request
@blueorangutan
Copy link

Packaging result: 鉁旓笍 el7 鉁旓笍 el8 鉁旓笍 debian 鉁旓笍 suse15. SL-JID 2109

@sureshanaparti
Copy link
Contributor

Change in error message string, smoke tests not needed. Merging based on approvals and author's test.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
No open projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Sensitive error message when list accounts
5 participants