vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Change API calls that expect non-robots to explicitly filter

Browse source 
Before this change, we'd filter in the UI but calls to the API could allow robots accounts where we only expect real users
This commit is contained in:
Joseph Schorr 2015-05-26 17:47:33 -04:00
parent e5e2384998
commit fdd43e2490
6 changed files with 21 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
endpoints/api/user.py
View file

@ -281,7 +281,7 @@ class User(ApiResource):
user_data = request.get_json()
invite_code = user_data.get('invite_code', '')
existing_user = model.get_user(user_data['username'])
existing_user = model.get_nonrobot_user(user_data['username'])
if existing_user:
raise request_error(message='The username already exists')
@ -821,8 +821,8 @@ class Users(ApiResource):
@nickname('getUserInformation')
def get(self, username):
""" Get user information for the specified user. """
user = model.get_user(username)
if user is None or user.organization or user.robot:
user = model.get_nonrobot_user(username)
if user is None:
abort(404)
return user_view(user)