Matthew Edmonds 4a4142e9b8 fix overaggressive 403->404 conversion ... When a user is not authorized to see a given resource, we need to convert HTTP 403s into HTTP 404s to avoid giving away information that the resource exists. However, the previous code was being overaggressive and doing this conversion even in some cases where the user is allowed to see the resource and really needs to know that what they were trying to do is forbidden, not be told that the resource doesn't exist. This fixes that logic to only do the 403 to 404 conversion when truly appropriate. Change-Id: I7a5b0a9e89c8a71490dd74497794a52489f46cd2 Closes-Bug: 1682621 (cherry picked from commit 2ae14cc9ad)		2017-09-11 19:58:49 +00:00
..
__init__.py	Remove invalid copyright headers under API module	2014-04-02 11:09:03 -07:00
attributes.py	Use DB field sizes instead of _MAX_LEN constants	2016-12-23 13:48:57 +00:00
base.py	fix overaggressive 403->404 conversion	2017-09-11 19:58:49 +00:00
resource.py	api: work around Routes cutting off suffix from resource id	2017-06-02 15:23:06 +00:00
resource_helper.py	Remove allow_pagination and allow_sorting config options	2016-11-29 12:34:19 +00:00
router.py	Remove allow_pagination and allow_sorting config options	2016-11-29 12:34:19 +00:00