opendev/gerrit
Code Issues Proposed changes

Remove required access permission to list account emails

Browse Source 
Remove the required capability permission to allow any user to
listing another user's emails.  There is no access restriction
for the account[1] and account detail[2] endpoints so removing
the access restriction for emails seems consistent.

[1] http://$host/accounts/$user
[2] http://$host/accounts/$user/detail

Bug: Issue 3754
Change-Id: Ie7a57ba9497932d5ab1ba49cae08f4ff9d0453c4
This commit is contained in:
Khai Do
2016-01-08 11:09:09 -08:00
committed by David Pursehouse
parent 41ecd39382
commit c49ae23c38
1 changed files with 1 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
gerrit-server/src/main/java/com/google/gerrit/server/account/GetEmails.java
View File

@@ -15,12 +15,7 @@
package com.google.gerrit.server.account; package com.google.gerrit.server.account;
import com.google.common.collect.Lists; import com.google.common.collect.Lists;
import com.google.gerrit.extensions.restapi.AuthException;
import com.google.gerrit.extensions.restapi.RestReadView; import com.google.gerrit.extensions.restapi.RestReadView;
import com.google.gerrit.server.CurrentUser;
import com.google.gwtorm.server.OrmException;
import com.google.inject.Inject;
import com.google.inject.Provider;
import com.google.inject.Singleton; import com.google.inject.Singleton;
import java.util.Collections; import java.util.Collections;
@@ -29,21 +24,9 @@ import java.util.List;
@Singleton @Singleton
public class GetEmails implements RestReadView<AccountResource> { public class GetEmails implements RestReadView<AccountResource> {
private final Provider<CurrentUser> self;
@Inject
public GetEmails(Provider<CurrentUser> self) {
this.self = self;
}
@Override @Override
public List<EmailInfo> apply(AccountResource rsrc) throws AuthException, public List<EmailInfo> apply(AccountResource rsrc) {
OrmException {
if (self.get() != rsrc.getUser()
&& !self.get().getCapabilities().canModifyAccount()) {
throw new AuthException("not allowed to list email addresses");
}
List<EmailInfo> emails = Lists.newArrayList(); List<EmailInfo> emails = Lists.newArrayList();
for (String email : rsrc.getUser().getEmailAddresses()) { for (String email : rsrc.getUser().getEmailAddresses()) {
if (email != null) { if (email != null) {