inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-14 17:58:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

REPO-1348/REPO-1349: implemented checks to guard against invalid fields

Browse Source 
Explicitly rejects fields: id, guid and role

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/BRANCHES/DEV/5.2.N/root@131408 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Matt Ward
2016-10-13 16:19:00 +00:00
parent 82f2708aa7
commit ba33a435d4
2 changed files with 57 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
source/java/org/alfresco/rest/api/sites/SiteEntityResource.java
View File

@@ -133,10 +133,28 @@ public class SiteEntityResource implements EntityResourceAction.Read<Site>,
@WebApiDescription(title="Update site", description="Update the Share site")
public Site update(String siteId, Site site, Parameters parameters)
{
// Until REPO-110 is solved, we need to explicitly test for the presence of fields
// on the Site object that aren't valid SiteUpdate fields. Once REPO-110 is solved,
// the update method will take a SiteUpdate as a parameter rather than a Site
// and only the correct fields will be exposed. Any attempt to access illegal fields
// should then result in the framework returning a 400 automatically.
if (site.getId() != null)
{
throw new InvalidArgumentException("Site update does not support field: id");
}
if (site.getGuid() != null)
{
throw new InvalidArgumentException("Site update does not support field: guid");
}
if (site.getRole() != null)
{
throw new InvalidArgumentException("Site update does not support field: role");
}
// Bind valid fields to a SiteUpdate instance.
final String title = site.getTitle();
final String description = site.getDescription();
final SiteVisibility visibility = site.getVisibility();
SiteUpdate update = new SiteUpdate(title, description, visibility);
return sites.updateSite(siteId, update, parameters);