diff --git a/docs-web/src/main/java/com/sismics/docs/rest/resource/ShareResource.java b/docs-web/src/main/java/com/sismics/docs/rest/resource/ShareResource.java index c6e421b4..364ccd68 100644 --- a/docs-web/src/main/java/com/sismics/docs/rest/resource/ShareResource.java +++ b/docs-web/src/main/java/com/sismics/docs/rest/resource/ShareResource.java @@ -91,12 +91,16 @@ public class ShareResource extends BaseResource { // Get the share ShareDao shareDao = new ShareDao(); DocumentDao documentDao = new DocumentDao(); - Share share; + Share share = shareDao.getShare(id); + if (share == null) { + throw new ClientException("ShareNotFound", MessageFormat.format("Share not found: {0}", id)); + } + + // Check that the user is the owner of the linked document try { - share = shareDao.getShare(id); documentDao.getDocument(share.getDocumentId(), principal.getId()); } catch (NoResultException e) { - throw new ClientException("ShareNotFound", MessageFormat.format("Share not found: {0}", id)); + throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", share.getDocumentId())); } // Delete the share diff --git a/docs-web/src/test/java/com/sismics/docs/rest/TestShareResource.java b/docs-web/src/test/java/com/sismics/docs/rest/TestShareResource.java index 443908c3..e69ca0f6 100644 --- a/docs-web/src/test/java/com/sismics/docs/rest/TestShareResource.java +++ b/docs-web/src/test/java/com/sismics/docs/rest/TestShareResource.java @@ -109,6 +109,16 @@ public class TestShareResource extends BaseJerseyTest { byte[] fileBytes = ByteStreams.toByteArray(is); Assert.assertEquals(163510, fileBytes.length); + // Deletes the share (not allowed) + clientUtil.createUser("share2"); + String share2AuthenticationToken = clientUtil.login("share2"); + shareResource = resource().path("/share/" + share1Id); + shareResource.addFilter(new CookieAuthenticationFilter(share2AuthenticationToken)); + response = shareResource.delete(ClientResponse.class); + Assert.assertEquals(Status.BAD_REQUEST, Status.fromStatusCode(response.getStatus())); + json = response.getEntity(JSONObject.class); + Assert.assertEquals("DocumentNotFound", json.getString("type")); + // Deletes the share shareResource = resource().path("/share/" + share1Id); shareResource.addFilter(new CookieAuthenticationFilter(share1AuthenticationToken)); @@ -117,5 +127,12 @@ public class TestShareResource extends BaseJerseyTest { json = response.getEntity(JSONObject.class); Assert.assertEquals("ok", json.getString("status")); + // Deletes the share again + shareResource = resource().path("/share/" + share1Id); + shareResource.addFilter(new CookieAuthenticationFilter(share1AuthenticationToken)); + response = shareResource.delete(ClientResponse.class); + Assert.assertEquals(Status.BAD_REQUEST, Status.fromStatusCode(response.getStatus())); + json = response.getEntity(JSONObject.class); + Assert.assertEquals("ShareNotFound", json.getString("type")); } } \ No newline at end of file