Chris Geer created RAVE-814:
-------------------------------
Summary: WidgetApi doesn't properly validate widget ID when
dealing with subordinate objects
Key: RAVE-814
URL: https://issues.apache.org/jira/browse/RAVE-814
Project: Rave
Issue Type: Bug
Reporter: Chris Geer
Priority: Minor
When getting/updating widget comments (and other objects) the widget ID isn't
validated. For example, if you have a widget with ID 2 and a comment with ID 7
you should be able to update that comment with this url:
http://localhost:8080/portal/app/api/rest/widgets/2/comments/7?text=update
That path works great but the problem is that is you use this path (Widget ID
999999) it also works
http://localhost:8080/portal/app/api/rest/widgets/999999/comments/7?text=shouldntupdate
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
