mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-09-30 03:36:25 +00:00
Code Issues Releases Wiki Activity

Remove the web console EPP endpoint

Browse Source 
This removes the "create Domain/Host/Contact" forms that were supposed to be used instead of regular EPPs for CC-TLD that wanted to support it.

We're removing it because we don't use it and want to reduce unneeded code for the registry 3.0 migration.

Also, this is a security risk, as it allowed to do "billable actions" (creating a new domain for example) with the only authentication being access to the registrar's G Suite account.

This bypassed the certificate, IP whitelist, and EPP password, which is bad.

PUBLIC:
Remove the web console EPP endpoint

This removes the "create Domain/Host/Contact" forms that were supposed to be used instead of regular EPPs for CC-TLD that wanted to support it.

We're removing it because we don't use it and want to reduce unneeded code for the registry 3.0 migration.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=236244195
This commit is contained in:
guyben
2019-03-05 14:20:42 -05:00
committed by Weimin Yu
parent f12d368da3
commit dfad79759e
52 changed files with 58 additions and 3788 deletions
Download Patch File Download Diff File Expand all files Collapse all files
javatests/google/registry/flows/FlowRunnerTest.java
-12
View File
@@ -26,14 +26,12 @@ import static org.mockito.Mockito.verify;
import com.google.common.base.Joiner;
import com.google.common.base.Splitter;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.ImmutableSetMultimap;
import com.google.common.flogger.LoggerConfig;
import com.google.common.testing.TestLogHandler;
import google.registry.model.eppcommon.Trid;
import google.registry.model.eppoutput.EppOutput.ResponseOrGreeting;
import google.registry.model.eppoutput.EppResponse;
import google.registry.monitoring.whitebox.EppMetric;
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
import google.registry.testing.AppEngineRule;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeHttpSession;
@@ -140,16 +138,6 @@ public class FlowRunnerTest extends ShardableTestCase {
+ "{clientId=TheRegistrar, failedLoginAttempts=0, serviceExtensionUris=}");
}
@Test
public void testRun_loggingStatement_gaeUserCredentials() throws Exception {
flowRunner.credentials =
new GaeUserCredentials(AuthenticatedRegistrarAccessor.createForTesting(
ImmutableSetMultimap.of()));
flowRunner.run(eppMetricBuilder);
assertThat(findFirstLogMessageByPrefix(handler, "EPP Command\n\t"))
.contains("user=TestUserId");
}
@Test
public void testRun_loggingStatement_tlsCredentials() throws Exception {
flowRunner.credentials = new TlsCredentials(true, "abc123def", Optional.of("127.0.0.1"));