vmario/docs
1
0
Fork 0
mirror of https://github.com/sismics/docs.git synced 2024-11-25 15:17:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

#647: always return OK on password lost route

Browse Source
This commit is contained in:
bgamard 2022-08-26 18:15:49 +02:00
parent 5e7f06070e
commit ca85c1fa9f
2 changed files with 12 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
docs-web/src/main/java/com/sismics/docs/rest/resource/UserResource.java
View File

@ -1081,11 +1081,16 @@ public class UserResource extends BaseResource {
// Validate input data // Validate input data
ValidationUtil.validateStringNotBlank("username", username); ValidationUtil.validateStringNotBlank("username", username);
// Prepare response
Response response = Response.ok().entity(Json.createObjectBuilder()
.add("status", "ok")
.build()).build();
// Check for user existence // Check for user existence
UserDao userDao = new UserDao(); UserDao userDao = new UserDao();
List<UserDto> userDtoList = userDao.findByCriteria(new UserCriteria().setUserName(username), null); List<UserDto> userDtoList = userDao.findByCriteria(new UserCriteria().setUserName(username), null);
if (userDtoList.isEmpty()) { if (userDtoList.isEmpty()) {
throw new ClientException("UserNotFound", "User not found: " + username); return response;
} }
UserDto user = userDtoList.get(0); UserDto user = userDtoList.get(0);
@ -1102,9 +1107,7 @@ public class UserResource extends BaseResource {
AppContext.getInstance().getMailEventBus().post(passwordLostEvent); AppContext.getInstance().getMailEventBus().post(passwordLostEvent);
// Always return OK // Always return OK
JsonObjectBuilder response = Json.createObjectBuilder() return response;
.add("status", "ok");
return Response.ok().entity(response.build()).build();
} }
/** /**

12
docs-web/src/test/java/com/sismics/docs/rest/TestUserResource.java
View File

@ -439,13 +439,11 @@ public class TestUserResource extends BaseJerseyTest {
// Create absent_minded who lost his password // Create absent_minded who lost his password
clientUtil.createUser("absent_minded"); clientUtil.createUser("absent_minded");
// User no_such_user try to recovery its password: invalid user // User no_such_user try to recovery its password: silently do nothing to avoid leaking users
Response response = target().path("/user/password_lost").request() JsonObject json = target().path("/user/password_lost").request()
.post(Entity.form(new Form() .post(Entity.form(new Form()
.param("username", "no_such_user"))); .param("username", "no_such_user")), JsonObject.class);
Assert.assertEquals(Response.Status.BAD_REQUEST, Response.Status.fromStatusCode(response.getStatus())); Assert.assertEquals("ok", json.getString("status"));
JsonObject json = response.readEntity(JsonObject.class);
Assert.assertEquals("UserNotFound", json.getString("type"));
// User absent_minded try to recovery its password: OK // User absent_minded try to recovery its password: OK
json = target().path("/user/password_lost").request() json = target().path("/user/password_lost").request()
@ -461,7 +459,7 @@ public class TestUserResource extends BaseJerseyTest {
String key = keyMatcher.group(1).replaceAll("=", ""); String key = keyMatcher.group(1).replaceAll("=", "");
// User absent_minded resets its password: invalid key // User absent_minded resets its password: invalid key
response = target().path("/user/password_reset").request() Response response = target().path("/user/password_reset").request()
.post(Entity.form(new Form() .post(Entity.form(new Form()
.param("key", "no_such_key") .param("key", "no_such_key")
.param("password", "87654321"))); .param("password", "87654321")));