Person permission check for creating [p]ppa subscription tokens
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Launchpad itself |
Fix Released
|
Low
|
Steve Kowalik | ||
Bug Description
IArchive will have a newAuthToken(
1) The person already has a current subscription for the archive (created by the archive owner separately)
2) The person does not already have a current token for the archive.
What the method cannot do is verify that the logged-in user calling the method (could be a view or webservice) has the launchpad.Edit permission of the person (more simply, that the callsite is logged in as the person). For this reason, the IArchive.
One possible solution would be to proxy the call via IPerson.
Related branches
- Jelmer Vernooij (community): Approve (code)
-
Diff: 212 lines (+83/-43)5 files modifiedlib/lp/soyuz/doc/archiveauthtoken.txt (+1/-8)
lib/lp/soyuz/interfaces/archive.py (+28/-19)
lib/lp/soyuz/model/archive.py (+20/-16)
lib/lp/soyuz/stories/webservice/xx-archive.txt (+10/-0)
lib/lp/soyuz/tests/test_archive.py (+24/-0)
| Michael Nelson (michael.nelson) wrote | #1 |
| Julian Edwards (julian-edwards) wrote | #2 |
| Changed in soyuz: | |
| importance: | Undecided → Low |
| status: | New → Triaged |
| tags: | added: p3a ppa |
| tags: | added: qa-ok |
| Ursula Junque (ursinha) wrote Bug fixed by a commit | #3 |
| Changed in soyuz: | |
| assignee: | nobody → Steve Kowalik (stevenk) |
| milestone: | none → 10.06 |
| tags: |
added: qa-needstesting removed: qa-ok |
| Changed in soyuz: | |
| status: | Triaged → Fix Committed |
| tags: |
added: qa-ok removed: qa-needstesting |
| Changed in soyuz: | |
| status: | Fix Committed → Fix Released |
A second possibility discussed is to add a user=None parameter to the IArchive.