Mercurial > p > roundup > code
comparison roundup/rest.py @ 6086:c172bd18fa94
REST API: 403 on non-searchable properties
issue2551051: Return a 403 on non-existing or non-searchable transitive
properties when queried via REST-API (same behavior for sorting and
searching).
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Wed, 12 Feb 2020 12:35:33 +0100 |
| parents | d56e290ecab7 |
| children | f564e5152134 00a24243887c |
comparison
equal
deleted
inserted
replaced
| 6085:7c8d3bd0deb6 | 6086:c172bd18fa94 |
|---|---|
| 694 # non-existing properties. | 694 # non-existing properties. |
| 695 if self.db.security.hasSearchPermission( | 695 if self.db.security.hasSearchPermission( |
| 696 uid, class_name, pn | 696 uid, class_name, pn |
| 697 ): | 697 ): |
| 698 sort.append((ss, pn)) | 698 sort.append((ss, pn)) |
| 699 else : | |
| 700 raise (Unauthorised ( | |
| 701 'User does not have search permission on "%s.%s"' | |
| 702 % (class_name, pn))) | |
| 699 elif key.startswith("@"): | 703 elif key.startswith("@"): |
| 700 # ignore any unsupported/previously handled control key | 704 # ignore any unsupported/previously handled control key |
| 701 # like @apiver | 705 # like @apiver |
| 702 pass | 706 pass |
| 703 else: # serve the filter purpose | 707 else: # serve the filter purpose |
| 719 # Note that hasSearchPermission already returns 0 for | 723 # Note that hasSearchPermission already returns 0 for |
| 720 # non-existing properties. | 724 # non-existing properties. |
| 721 if not self.db.security.hasSearchPermission( | 725 if not self.db.security.hasSearchPermission( |
| 722 uid, class_name, key | 726 uid, class_name, key |
| 723 ): | 727 ): |
| 724 continue | 728 raise (Unauthorised ( |
| 729 'User does not have search permission on "%s.%s"' | |
| 730 % (class_name, key))) | |
| 725 | 731 |
| 726 linkcls = class_obj | 732 linkcls = class_obj |
| 727 for p in key.split('.'): | 733 for p in key.split('.'): |
| 728 prop = linkcls.getprops(protected=True)[p] | 734 prop = linkcls.getprops(protected=True)[p] |
| 729 linkcls = getattr(prop, 'classname', None) | 735 linkcls = getattr(prop, 'classname', None) |