8198: consider X-Forwarded-For header by way of request.repote_ip while setting node...

[arvados.git] / services / api / app / controllers / arvados / v1 / api_client_authorizations_controller.rb

diff --git a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
index 4a2bafde04eda0dc6c3639d963796a1d95734c8a..f365a7fee8996e7c9ba51cdd11bc4d525c3e9193 100644 (file)
--- a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
+++ b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
@@ -21,6 +21,12 @@ class Arvados::V1::ApiClientAuthorizationsController < ApplicationController
   end
 
   def create
+    # Note: the user could specify a owner_uuid for a different user, which on
+    # the surface appears to be a security hole.  However, the record will be
+    # rejected before being saved to the database by the ApiClientAuthorization
+    # model which enforces that user_id == current user or the user is an
+    # admin.
+
     if resource_attrs[:owner_uuid]
       # The model has an owner_id attribute instead of owner_uuid, but
       # we can't expect the client to know the local numeric ID. We
@@ -76,7 +82,8 @@ class Arvados::V1::ApiClientAuthorizationsController < ApplicationController
 
   def current_api_client_is_trusted
     unless Thread.current[:api_client].andand.is_trusted
-      render :json => { errors: ['Forbidden: this API client cannot manipulate other clients\' access tokens.'] }.to_json, status: 403
+      send_error('Forbidden: this API client cannot manipulate other clients\' access tokens.',
+                 status: 403)
     end
   end
 end