Raise forbidden error if un authenticated users load email api. #1548

newswangerd · 2019-02-12T16:16:35Z

chouseknecht · 2019-02-13T17:39:50Z

galaxy/api/views/email.py

 class UserEmailList(base_views.SubListAPIView):
    model = EmailAddress
    serializer_class = serializers.EmailSerializer
    parent_model = User
    relationship = 'emailaddress_set'

    def get_queryset(self):
+        deny_anonymous_users(self.request.user)


I think this should be handled in access.py

Definitely get_queryset() is not the best place for checking user permissions.
Please use permission_classes = (IsAuthenticated,)

cutwater · 2019-02-13T18:01:00Z

galaxy/api/views/email.py

 class UserEmailList(base_views.SubListAPIView):
    model = EmailAddress
    serializer_class = serializers.EmailSerializer
    parent_model = User
    relationship = 'emailaddress_set'

    def get_queryset(self):
+        deny_anonymous_users(self.request.user)


Definitely get_queryset() is not the best place for checking user permissions.
Please use permission_classes = (IsAuthenticated,)

…ble#1548) * Raise forbidden error if un authenticated users load email api. * Switch to using permission classes. (cherry picked from commit e0b7f94)

… (#1592) * Raise forbidden error if un authenticated users load email api. * Switch to using permission classes. (cherry picked from commit e0b7f94)

Raise forbidden error if un authenticated users load email api.

d557d57

newswangerd requested a review from chouseknecht February 12, 2019 16:16

chouseknecht suggested changes Feb 13, 2019

View reviewed changes

cutwater requested changes Feb 13, 2019

View reviewed changes

Switch to using permission classes.

6dbaa0a

cutwater approved these changes Feb 14, 2019

View reviewed changes

newswangerd merged commit e0b7f94 into ansible:devel Feb 27, 2019

newswangerd mentioned this pull request Feb 27, 2019

Raise forbidden error if un authenticated users load email api. (#1548) #1592

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Raise forbidden error if un authenticated users load email api. #1548

Raise forbidden error if un authenticated users load email api. #1548

newswangerd commented Feb 12, 2019

chouseknecht Feb 13, 2019

cutwater Feb 13, 2019

cutwater Feb 13, 2019

Raise forbidden error if un authenticated users load email api. #1548

Raise forbidden error if un authenticated users load email api. #1548

Conversation

newswangerd commented Feb 12, 2019

chouseknecht Feb 13, 2019

Choose a reason for hiding this comment

cutwater Feb 13, 2019

Choose a reason for hiding this comment

cutwater Feb 13, 2019

Choose a reason for hiding this comment