Skip to content

server: do not return inaccessible entity details to normal users#5827

Merged
sureshanaparti merged 1 commit into
apache:4.16from
shapeblue:fix-list-acc-err
Jan 6, 2022
Merged

server: do not return inaccessible entity details to normal users#5827
sureshanaparti merged 1 commit into
apache:4.16from
shapeblue:fix-list-acc-err

Conversation

@shwstppr
Copy link
Copy Markdown
Contributor

@shwstppr shwstppr commented Jan 6, 2022

Description

Fixes #5534

As pre 3.x APIs allow using internal DB IDs, even normal users can use internal IDs.
This fix removes additional information in error message when the caller doesn't have access to the resource.

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

Screenshots (if appropriate):

How Has This Been Tested?

Before

(local) 🐤 > list accounts id=2
🙈 Error: (HTTP 531, error code 4365) Acct[c6de2628-5a8e-4d68-a95d-2f407db1612d-user] -- Account {"id": 4, "name": "user", "uuid": "c6de2628-5a8e-4d68-a95d-2f407db1612d"} does not have permission to operate with resource Acct[54e1efd3-6951-11ec-919d-645d8651f45a-admin] -- Account {"id": 2, "name": "admin", "uuid": "54e1efd3-6951-11ec-919d-645d8651f45a"}

After

(local) 🐬 > list accounts id=2
🙈 Error: (HTTP 531, error code 4365) Acct[c6de2628-5a8e-4d68-a95d-2f407db1612d-user] -- Account {"id": 4, "name": "user", "uuid": "c6de2628-5a8e-4d68-a95d-2f407db1612d"} does not have permission to operate with resource

Fixes apache#5534

As pre 3.x APIs allow using internal DB IDs, even normal users can use internal IDs.
This fix removes additional information in error message when the caller doesn't have access to the resource.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Copy link
Copy Markdown
Member

@yadvr yadvr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Refactoring LGTM

@yadvr yadvr added this to the 4.16.1.0 milestone Jan 6, 2022
Copy link
Copy Markdown
Contributor

@sureshanaparti sureshanaparti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sureshanaparti
Copy link
Copy Markdown
Contributor

@blueorangutan package

@blueorangutan
Copy link
Copy Markdown

@sureshanaparti a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

Copy link
Copy Markdown
Member

@weizhouapache weizhouapache left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code LGTM

@weizhouapache weizhouapache linked an issue Jan 6, 2022 that may be closed by this pull request
@blueorangutan
Copy link
Copy Markdown

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 2109

@sureshanaparti
Copy link
Copy Markdown
Contributor

Change in error message string, smoke tests not needed. Merging based on approvals and author's test.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

No open projects
Status: Done

Development

Successfully merging this pull request may close these issues.

Sensitive error message when list accounts

5 participants