zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-14 00:17:20 +02:00
Code Issues Projects Releases Packages Wiki Activity

Do not require auth info in super user transfer

Browse source 
Super users can look up auth info in Datastore or BigQuery backup anyway.
Requiring it only adds friction when using the super user extension, without
any additional security benefit.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=235786090
This commit is contained in:
jianglai 2019-02-26 13:51:43 -08:00 • committed by Weimin Yu
parent e9f2a49e9a
commit d3a6d5483e
2 changed files with 4 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
java/google/registry/flows/domain/DomainTransferRequestFlow.java
View file

@ -254,8 +254,10 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
Optional<DomainTransferRequestSuperuserExtension> superuserExtension)
throws EppException {
verifyNoDisallowedStatuses(existingDomain, DISALLOWED_STATUSES);
if (!isSuperuser) {
verifyAuthInfoPresentForResourceTransfer(authInfo);
verifyAuthInfo(authInfo.get(), existingDomain);
}
// Verify that the resource does not already have a pending transfer.
if (TransferStatus.PENDING.equals(existingDomain.getTransferData().getTransferStatus())) {
throw new AlreadyPendingTransferException(targetId);

3
javatests/google/registry/flows/domain/testdata/domain_transfer_request_superuser_extension.xml vendored
View file

@ -4,9 +4,6 @@
<domain:transfer
xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
<domain:name>example.tld</domain:name>
<domain:authInfo>
<domain:pw roid="JD1234-REP">2fooBAR</domain:pw>
</domain:authInfo>
</domain:transfer>
</transfer>
<extension>