zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-29 17:00:11 +02:00
Code Issues Projects Releases Packages Wiki Activity

Block ability to remove allowed TLDs from the registrar console

Browse source 
This is a temporary measure until we implement access control for Support.

Once we implement access control, we will only block Support from removing TLDs
on production.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=222180321
This commit is contained in:
guyben 2018-11-19 19:50:02 -08:00 • committed by jianglai
parent f46f817f9e
commit 274b7115d4
2 changed files with 36 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
java/google/registry/ui/server/registrar/RegistrarSettingsAction.java
View file

@ -29,6 +29,7 @@ import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.Multimap;
import com.google.common.collect.Sets;
import com.google.common.collect.Streams;
import com.google.common.flogger.FluentLogger;
import google.registry.config.RegistryConfig.Config;
@ -298,11 +299,19 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
RegistrarFormFields.ALLOWED_TLDS_FIELD.extractUntyped(args).orElse(ImmutableSet.of());
if (!updatedAllowedTlds.equals(existingRegistrarObj.getAllowedTlds())) {
// Only admin is allowed to update allowed TLDs
if (roles.contains(Role.ADMIN)) {
builder.setAllowedTlds(updatedAllowedTlds);
} else {
if (!roles.contains(Role.ADMIN)) {
throw new ForbiddenException("Only admin can update allowed TLDs.");
}
// Temporarily block anyone from removing an allowed TLD.
// This is so we can start having Support users use the console in production before we finish
// implementing configurable access control.
// TODO(b/119549884): remove this code once configurable access control is implemented.
Set<String> removedTlds =
Sets.difference(existingRegistrarObj.getAllowedTlds(), updatedAllowedTlds);
if (!removedTlds.isEmpty()) {
throw new ForbiddenException("Can't remove allowed TLDs using the console.");
}
builder.setAllowedTlds(updatedAllowedTlds);
}
}