X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/4609a76d9b84e0f63233cdf6dcbef376b1686b69..2b6837ef2b57204b7bf4fd5c4373283892999268:/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb

diff --git a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
index 4a2bafde04..f365a7fee8 100644
--- a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
+++ b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb
@@ -21,6 +21,12 @@ class Arvados::V1::ApiClientAuthorizationsController < ApplicationController
   end
 
   def create
+    # Note: the user could specify a owner_uuid for a different user, which on
+    # the surface appears to be a security hole.  However, the record will be
+    # rejected before being saved to the database by the ApiClientAuthorization
+    # model which enforces that user_id == current user or the user is an
+    # admin.
+
     if resource_attrs[:owner_uuid]
       # The model has an owner_id attribute instead of owner_uuid, but
       # we can't expect the client to know the local numeric ID. We
@@ -76,7 +82,8 @@ class Arvados::V1::ApiClientAuthorizationsController < ApplicationController
 
   def current_api_client_is_trusted
     unless Thread.current[:api_client].andand.is_trusted
-      render :json => { errors: ['Forbidden: this API client cannot manipulate other clients\' access tokens.'] }.to_json, status: 403
+      send_error('Forbidden: this API client cannot manipulate other clients\' access tokens.',
+                 status: 403)
     end
   end
 end