vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Change API calls that expect non-robots to explicitly filter

Browse source 
Before this change, we'd filter in the UI but calls to the API could allow robots accounts where we only expect real users
This commit is contained in:
Joseph Schorr 2015-05-26 17:47:33 -04:00
parent e5e2384998
commit fdd43e2490
6 changed files with 21 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

16
endpoints/api/superuser.py
View file

@ -238,8 +238,8 @@ class SuperUserSendRecoveryEmail(ApiResource):
@nickname('sendInstallUserRecoveryEmail')
def post(self, username):
if SuperUserPermission().can():
user = model.get_user(username)
if not user or user.organization or user.robot:
user = model.get_nonrobot_user(username)
if not user:
abort(404)
if superusers.is_superuser(username):
@ -288,8 +288,8 @@ class SuperUserManagement(ApiResource):
def get(self, username):
""" Returns information about the specified user. """
if SuperUserPermission().can():
user = model.get_user(username)
if not user or user.organization or user.robot:
user = model.get_nonrobot_user(username)
if not user:
abort(404)
return user_view(user)
@ -302,8 +302,8 @@ class SuperUserManagement(ApiResource):
def delete(self, username):
""" Deletes the specified user. """
if SuperUserPermission().can():
user = model.get_user(username)
if not user or user.organization or user.robot:
user = model.get_nonrobot_user(username)
if not user:
abort(404)
if superusers.is_superuser(username):
@ -321,8 +321,8 @@ class SuperUserManagement(ApiResource):
def put(self, username):
""" Updates information about the specified user. """
if SuperUserPermission().can():
user = model.get_user(username)
if not user or user.organization or user.robot:
user = model.get_nonrobot_user(username)
if not user:
abort(404)
if superusers.is_superuser(username):