mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-01-09 15:43:52 +00:00
Code Issues Releases Wiki Activity

Check registrar existence prior to verifying access

Browse Source 
This way the error messages are more sensible when a registrar doesn't exist
(which realistically shouldn't happen in the typical case anyway).

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=240376239
This commit is contained in:
mcilwain
2019-03-26 10:30:39 -07:00
committed by jianglai
parent e1abef7b3e
commit 26eda15d47
3 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
java/google/registry/request/auth/AuthenticatedRegistrarAccessor.java
View File

@@ -220,16 +220,13 @@ public class AuthenticatedRegistrarAccessor {
* @param clientId ID of the registrar we request
*/
public Registrar getRegistrar(String clientId) throws RegistrarAccessDeniedException {
// Verify access before checking if the registrar exists, in order to not leak information
// about objects in the system the user doesn't have permissions on.
verifyAccess(clientId);
Registrar registrar =
Registrar.loadByClientId(clientId)
.orElseThrow(
() ->
new RegistrarAccessDeniedException(
String.format("Registrar %s not found", clientId)));
String.format("Registrar %s does not exist", clientId)));
verifyAccess(clientId);
if (!clientId.equals(registrar.getClientId())) {
logger.atSevere().log(