Marmelator/persistence-service
1
0
Fork 0
Code Issues Pull Requests 17 Actions Packages Projects Releases 1.1k Wiki Activity

RED-6034 - Possible to assign a file to unauthorized users

Browse Source 
- change status from 403 to 400
This commit is contained in:
devplant 2023-05-04 09:44:57 +03:00
parent 23d49172d5
commit d09da8ea78
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
persistence-service-v1/persistence-service-processor-v1/src/main/java/com/iqser/red/service/persistence/management/v1/processor/service/AccessControlService.java
View File

@ -6,6 +6,7 @@ import org.springframework.stereotype.Service;
import com.iqser.red.keycloak.commons.KeycloakSecurity;
import com.iqser.red.service.persistence.management.v1.processor.acl.custom.dossier.DossierACLService;
import com.iqser.red.service.persistence.management.v1.processor.exception.BadRequestException;
import com.iqser.red.service.persistence.management.v1.processor.exception.NotAllowedException;
import com.iqser.red.service.persistence.management.v1.processor.exception.NotFoundException;
import com.iqser.red.service.persistence.service.v1.api.shared.model.dossiertemplate.dossier.file.WorkflowStatus;
@ -69,7 +70,7 @@ public class AccessControlService {
var isMember = dossier.getMemberIds().contains(userId);
var isApprover = dossier.getApproverIds().contains(userId);
if (!isMember && !isApprover) {
throw new NotAllowedException("User must be dossier member or approver.");
throw new BadRequestException("User must be dossier member or approver.");
}
}