From 40cedbe09d7e8fe3223ebe3da14d7d6983b22df1 Mon Sep 17 00:00:00 2001 From: Peter Amstutz Date: Thu, 12 Jun 2014 11:14:03 -0400 Subject: [PATCH] Made a note about user how permissions are applied when attempting to create a token for another user. Test for this case already exists. closes #2350. --- .../arvados/v1/api_client_authorizations_controller.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb index 4a2bafde04..76a228d9d5 100644 --- a/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb +++ b/services/api/app/controllers/arvados/v1/api_client_authorizations_controller.rb @@ -21,6 +21,12 @@ class Arvados::V1::ApiClientAuthorizationsController < ApplicationController end def create + # Note: the user could specify a owner_uuid for a different user, which on + # the surface appears to be a security hole. However, the record will be + # rejected before being saved to the database by the ApiClientAuthorization + # model which enforces that user_id == current user or the user is an + # admin. + if resource_attrs[:owner_uuid] # The model has an owner_id attribute instead of owner_uuid, but # we can't expect the client to know the local numeric ID. We -- 2.30.2