mraible commented on code in PR #164:
URL: https://github.com/apache/roller/pull/164#discussion_r3891399232
##########
app/src/main/java/org/apache/roller/weblogger/webservices/xmlrpc/BaseAPIHandler.java:
##########
@@ -102,97 +105,112 @@ public BaseAPIHandler() {
//------------------------------------------------------------------------
/**
- * Returns website, but only if user authenticates and is authorized to
edit.
- * @param blogid Blogid sent in request (used as website's handle)
- * @param username Username sent in request
- * @param password Password sent in request
+ * Returns a weblog only when the authenticated user has the requested
+ * permission and XML-RPC access is enabled for that weblog.
*/
- protected Weblog validate(String blogid, String username, String password)
- throws Exception {
- boolean authenticated = false;
- boolean userEnabled = false;
- boolean weblogEnabled = false;
- boolean apiEnabled = false;
- boolean weblogFound = false;
- Weblog website = null;
- try {
- UserManager userMgr =
WebloggerFactory.getWeblogger().getUserManager();
- WeblogManager weblogMgr =
WebloggerFactory.getWeblogger().getWeblogManager();
- User user = userMgr.getUserByUserName(username);
-
- website = weblogMgr.getWeblogByHandle(blogid);
- if (website != null) {
- weblogFound = true;
- weblogEnabled = website.getVisible();
- apiEnabled = website.getEnableBloggerApi()
- &&
WebloggerRuntimeConfig.getBooleanProperty("webservices.enableXmlRpc");
- }
-
- if (user != null) {
- userEnabled = user.getEnabled();
- authenticated =
RollerContext.getPasswordEncoder().matches(password, user.getPassword());
- }
- } catch (Exception e) {
- mLogger.error("ERROR internal error validating user", e);
- }
-
- if ( !authenticated ) {
- throw new
XmlRpcNotAuthorizedException(AUTHORIZATION_EXCEPTION_MSG);
- }
- if ( !userEnabled ) {
- throw new XmlRpcNotAuthorizedException(USER_DISABLED_MSG);
- }
- if ( !weblogEnabled ) {
+ protected Weblog validate(String blogid, String username, String password,
+ String requiredAction) throws Exception {
+ User user = validateUser(username, password);
+ return validateWeblog(blogid, user, requiredAction);
+ }
+
+ /**
+ * Validate a weblog for an already authenticated user.
+ */
+ protected Weblog validateWeblog(String blogid, User user,
+ String requiredAction) throws Exception {
+ WeblogManager weblogMgr =
WebloggerFactory.getWeblogger().getWeblogManager();
+ Weblog website = weblogMgr.getWeblogByHandle(blogid);
+
+ // Use one response for missing, unavailable, and inaccessible weblogs.
+ if (!isWeblogAvailable(website)
+ || !website.hasUserPermission(user, requiredAction)) {
throw new XmlRpcNotAuthorizedException(WEBLOG_DISABLED_MSG);
}
- if ( !weblogFound ) {
- throw new XmlRpcException(WEBLOG_NOT_FOUND, WEBLOG_NOT_FOUND_MSG);
- }
- if ( !apiEnabled ) {
+ if (!Boolean.TRUE.equals(website.getEnableBloggerApi())) {
throw new XmlRpcNotAuthorizedException(BLOGGERAPI_DISABLED_MSG);
}
return website;
}
//------------------------------------------------------------------------
/**
- * Returns true if username/password are valid and user is not disabled.
+ * Returns the authenticated user if username/password are valid and the
+ * user is not disabled.
* @param username Username sent in request
* @param password Password sent in request
*/
- protected boolean validateUser(String username, String password)
- throws Exception {
+ protected User validateUser(String username, String password)
+ throws Exception {
+ User user = null;
boolean authenticated = false;
- boolean enabled = false;
- boolean apiEnabled = false;
try {
-
UserManager userMgr =
WebloggerFactory.getWeblogger().getUserManager();
- User user = userMgr.getUserByUserName(username);
-
- if (user != null) {
- enabled = user.getEnabled();
- authenticated =
RollerContext.getPasswordEncoder().matches(password, user.getPassword());
-
- apiEnabled =
WebloggerRuntimeConfig.getBooleanProperty("webservices.enableXmlRpc");
+ user = userMgr.getUserByUserName(username);
+ if (user != null && RollerContext.getPasswordEncoder() != null) {
+ authenticated = RollerContext.getPasswordEncoder().matches(
+ password, user.getPassword());
}
} catch (Exception e) {
mLogger.error("ERROR internal error validating user", e);
}
-
- if ( !authenticated ) {
+
+ if (!authenticated) {
throw new
XmlRpcNotAuthorizedException(AUTHORIZATION_EXCEPTION_MSG);
}
-
- if ( !enabled ) {
+
+ if (!Boolean.TRUE.equals(user.getEnabled())) {
throw new XmlRpcNotAuthorizedException(USER_DISABLED_MSG);
}
-
- if ( !apiEnabled ) {
+
+ if
(!WebloggerRuntimeConfig.getBooleanProperty("webservices.enableXmlRpc")) {
throw new XmlRpcNotAuthorizedException(BLOGGERAPI_DISABLED_MSG);
- }
-
- return authenticated;
+ }
+
+ return user;
+ }
+
+ /**
+ * Returns an entry only when it belongs to an available XML-RPC weblog and
+ * the user may edit it. An optional additional weblog action can be
+ * required for transitions such as publishing.
+ */
+ protected WeblogEntry validateEntry(String postid, User user,
+ String additionalAction) throws Exception {
+ WeblogEntry entry = getEntryForWrite(postid, user, additionalAction);
+ if (entry == null) {
+ throw new XmlRpcException(INVALID_POSTID, INVALID_POSTID_MSG);
Review Comment:
I read the description's "foreign and unknown identifiers produce the same
fault" as deliberate anti-enumeration, which makes sense for entries the caller
can't see. This also covers the case where the caller can see and edit the
entry and only lacks POST: a limited member who just saved a draft with
`publish=false` retries with `publish=true` and gets `INVALID_POSTID` for the
id that worked seconds ago. Clients that treat that fault as "deleted on the
server" will drop or re-create the post. For an entry the caller already has
access to, a not-authorized fault leaks nothing and is far kinder.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
