Fix PUT behavior with User-Restricted Resource Access #1130
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nicolaiarocci
requested changes
Apr 3, 2018
| auth_field, | ||
| request_auth_value) | ||
| ) | ||
| desc = 'Incompatible User-Restricted Resource ' \ |
There was a problem hiding this comment.
this might disclose a little too much info to the client. Yes, the desc field is only emitted in debug mode, but you never know someone might leave debug on by mistake.
There was a problem hiding this comment.
The description string was already present, I didn't change it. I simply restructured this piece of code to fix a Flake8 line too long error. Do you want me to change the description anyway? What should I write?
There was a problem hiding this comment.
Yes, you are right, it was there already. Let us obfuscate it a little bit, maybe by simply returning the first part of the message (drop the "request was for but xx was excpected")
nicolaiarocci
approved these changes
Apr 3, 2018
nicolaiarocci
added a commit
that referenced
this pull request
Apr 3, 2018
lexhung
added a commit
to lexhung/eve
that referenced
this pull request
Dec 12, 2018
* upstream/master: (32 commits) Get rid of unwanted .vscode folder Add support for mongo $box geo query operator Marsch Huynh Improve partial downloads documentation Changelog for pyeve#1050 Test coverage for pyeve#1050 A little refactoring (DRY). Addresses pyeve#1050. fix: media endpoint Support partial request for media resource Officially deprecate Python 2.6 Changelog for pyeve#1130 Reduced error description details Fix PUT behavior with User-Restricted Resource Access flake8 typo Hung Le Changelog for pyeve#1095. Regression test for PR pyeve#1095. Oplog skipped even if confg.OPLOG=True DHuan ...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes the behavior of PUT requests when User-Restricted Resource Access is enabled.
More in particular it ensures that, under every circumstance, users are unable to overwrite items owned by other users.