opendev/gerrit
Code Issues Proposed changes

Remove the non-permission check #isHidden from ProjectControl

Browse Source 
PermissionBackend is supposed to only contain permission related checks.
Apparently, this #isHidden is a project state check rather than a
permission check. Thus it should be removed from the ProjectControl,
which is part of the DefaultPermissionBackend.

Before removing this, "ACCESS" permission checks for hidden projects will
only succeed for the project owners. After removing, they may also succeed
for other users, e.g. internal user.

The existing checks for "ACCESS" could be divided into two categories
base on whether it's helpful for users to change the configuration of
the project state or not.

For the helpful case, this commit preserves the current behavior of
the "ACCESS" check on hidden projects by checking the "READ_CONFIG"
permission which will only succeed for the project owners. For the
other case, this commit rejects directly even for project owners if
the project is hidden.

Change-Id: I20743e6380129eea7cb942d8d9ccad314e29d187
This commit is contained in:
Changcheng Xiao
2018-03-26 16:10:18 +02:00
parent f47dd2d416
commit da44fe4ba2
15 changed files with 116 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/com/google/gerrit/server/restapi/project/ProjectsCollection.java
View File

@@ -150,8 +150,14 @@ public class ProjectsCollection
}
if (checkAccess) {
// Hidden projects(permitsRead = false) should only be accessible by the project owners.
// READ_CONFIG is checked here because it's only allowed to project owners(ACCESS may also
// be allowed for other users). Allowing project owners to access here will help them to view
// and update the config of hidden projects easily.
ProjectPermission permissionToCheck =
state.statePermitsRead() ? ProjectPermission.ACCESS : ProjectPermission.READ_CONFIG;
try {
permissionBackend.currentUser().project(nameKey).check(ProjectPermission.ACCESS);
permissionBackend.currentUser().project(nameKey).check(permissionToCheck);
} catch (AuthException e) {
return null; // Pretend like not found on access denied.
}