opendev/gerrit
Code Issues Proposed changes

Convert parsing projects to use PermissionBackend

Browse Source 
When parsing a project name from a command line argument or in the
REST API, check the caller has ACCESS permission using
PermissionBackend, failing if they don't.

In UploadArchive check READ permission to determine if the
reachability check can be skipped.

Change-Id: I8b9155834a4ab36b964e339f5d9e1d110f771158
This commit is contained in:
Shawn Pearce
2017-02-23 11:39:01 -08:00
committed by David Pursehouse
parent 0527c60251
commit 8ea6df30a2
12 changed files with 88 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
gerrit-server/src/main/java/com/google/gerrit/server/api/changes/ChangesImpl.java
View File

@@ -32,6 +32,7 @@ import com.google.gerrit.extensions.restapi.Url;
import com.google.gerrit.reviewdb.client.Change;
import com.google.gerrit.server.change.ChangesCollection;
import com.google.gerrit.server.change.CreateChange;
import com.google.gerrit.server.permissions.PermissionBackendException;
import com.google.gerrit.server.project.InvalidChangeOperationException;
import com.google.gerrit.server.query.change.QueryChanges;
import com.google.gerrit.server.update.UpdateException;
@@ -87,7 +88,11 @@ class ChangesImpl implements Changes {
try {
ChangeInfo out = createChange.apply(TopLevelResource.INSTANCE, in).value();
return api.create(changes.parse(new Change.Id(out._number)));
} catch (OrmException | IOException | InvalidChangeOperationException | UpdateException e) {
} catch (OrmException
| IOException
| InvalidChangeOperationException
| UpdateException
| PermissionBackendException e) {
throw new RestApiException("Cannot create change", e);
}
}

2
gerrit-server/src/main/java/com/google/gerrit/server/api/groups/GroupsImpl.java
View File

@@ -122,7 +122,7 @@ class GroupsImpl implements Groups {
for (String project : req.getProjects()) {
try {
list.addProject(projects.parse(tlr, IdString.fromDecoded(project)).getControl());
} catch (IOException e) {
} catch (IOException | PermissionBackendException e) {
throw new RestApiException("Error looking up project " + project, e);
}
}

2
gerrit-server/src/main/java/com/google/gerrit/server/api/projects/ProjectApiImpl.java
View File

@@ -389,7 +389,7 @@ public class ProjectApiImpl implements ProjectApi {
public ChildProjectApi child(String name) throws RestApiException {
try {
return childApi.create(children.parse(checkExists(), IdString.fromDecoded(name)));
} catch (IOException e) {
} catch (IOException | PermissionBackendException e) {
throw new RestApiException("Cannot parse child project", e);
}
}

5
gerrit-server/src/main/java/com/google/gerrit/server/api/projects/ProjectsImpl.java
View File

@@ -21,6 +21,7 @@ import com.google.gerrit.extensions.common.ProjectInfo;
import com.google.gerrit.extensions.restapi.BadRequestException;
import com.google.gerrit.extensions.restapi.RestApiException;
import com.google.gerrit.extensions.restapi.UnprocessableEntityException;
import com.google.gerrit.server.permissions.PermissionBackendException;
import com.google.gerrit.server.project.ListProjects;
import com.google.gerrit.server.project.ListProjects.FilterType;
import com.google.gerrit.server.project.ProjectsCollection;
@@ -52,8 +53,8 @@ class ProjectsImpl implements Projects {
return api.create(projects.parse(name));
} catch (UnprocessableEntityException e) {
return api.create(name);
} catch (IOException e) {
throw new RestApiException("Cannot retrieve project");
} catch (IOException | PermissionBackendException e) {
throw new RestApiException("Cannot retrieve project", e);
}
}