opendev/gerrit
Code Issues Proposed changes

Always setLastLoginExternalIdKey for IdentifiedUsers

Browse Source 
Anonymous users have no login external id key, so it makes no sense to
set it for them in the read path.

The two callers for this property are GetExternalIds and
DeleteExternalIds.  The latter is not a read method and should expect
to have the current value to prevent the user from deleting their
current external id.

Change-Id: Id0671530fe649e6b0fcfd489fc384e37a2fd02e2
This commit is contained in:
Shawn Pearce
2017-08-09 08:09:46 -07:00
parent 96677009ad
commit 7cf423d608
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
gerrit-httpd/src/main/java/com/google/gerrit/httpd/restapi/RestApiServlet.java
View File

@@ -1147,7 +1147,6 @@ public class RestApiServlet extends HttpServlet {
CurrentUser user = globals.currentUser.get(); CurrentUser user = globals.currentUser.get();
if (isRead(req)) { if (isRead(req)) {
user.setAccessPath(AccessPath.REST_API); user.setAccessPath(AccessPath.REST_API);
user.setLastLoginExternalIdKey(globals.webSession.get().getLastLoginExternalId());
} else if (user instanceof AnonymousUser) { } else if (user instanceof AnonymousUser) {
throw new AuthException("Authentication required"); throw new AuthException("Authentication required");
} else if (!globals.webSession.get().isAccessPathOk(AccessPath.REST_API)) { } else if (!globals.webSession.get().isAccessPathOk(AccessPath.REST_API)) {
@@ -1155,6 +1154,9 @@ public class RestApiServlet extends HttpServlet {
"Invalid authentication method. In order to authenticate, " "Invalid authentication method. In order to authenticate, "
+ "prefix the REST endpoint URL with /a/ (e.g. http://example.com/a/projects/)."); + "prefix the REST endpoint URL with /a/ (e.g. http://example.com/a/projects/).");
} }
if (user.isIdentifiedUser()) {
user.setLastLoginExternalIdKey(globals.webSession.get().getLastLoginExternalId());
}
} }
private static boolean isRead(HttpServletRequest req) { private static boolean isRead(HttpServletRequest req) {