Fixes updateAttributes endpoint #10958
Conversation
GPortas
commented
Oct 23, 2024
•
GPortas
commented
- Closes: https://github.com/IQSS/dataverse-security/issues/98
This comment has been minimized.
This comment has been minimized.
GPortas
added
SPA.Q4
GPortas
added
Size: 3
|
📦 Pushed preview images as 🚢 See on GHCR. Use by referencing with full name as printed above, mind the registry name. |
| } | ||
| if (!ctxt.settings().isTrueForKey(SettingsServiceBean.Key.AllowEnablingFilePIDsPerCollection, false)) { | ||
| throw new PermissionException("Changing File PID policy per collection is not enabled on this server", | ||
| this, Collections.singleton(Permission.EditDataset), dataverse); |
There was a problem hiding this comment.
Minor point, but if we get here we have a super user so wouldn't it be an illegal command exception - not a permission exception?
There was a problem hiding this comment.
I initially thought the same, but I chose to use the PermissionException since that was the original exception thrown before moving this logic into the command. It's not a significant backward compatibility issue, but that was the reason behind my decision. However, I can switch to the IllegalCommandException if you think it fits better.
| changeAttributeResp = UtilIT.setCollectionAttribute("root", "name", newCollectionName, apiToken); | ||
| changeAttributeResp.then().assertThat() | ||
| .statusCode(UNAUTHORIZED.getStatusCode()); | ||
|
|
There was a problem hiding this comment.
You're not asserting anything that is particular to Root here, correct? Any random user without Edit Dataverse permissions would get the same Unauthorized on any Dataverse
