zydronium/internetee-registry
1
0
Fork 0
mirror of https://github.com/internetee/registry.git synced 2025-05-19 10:49:39 +02:00
Code Issues Projects Releases Packages Wiki Activity

Updated contact commands authorization

Browse source
This commit is contained in:
Andres Keskküla 2014-09-01 11:48:07 +03:00
parent a9df2c82b1
commit 13dad4cfcb
2 changed files with 15 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
app/helpers/epp/contacts_helper.rb
View file

@ -10,7 +10,7 @@ module Epp::ContactsHelper
# FIXME: Update returns 2303 update multiple times # FIXME: Update returns 2303 update multiple times
code = params_hash['epp']['command']['update']['update'][:id] code = params_hash['epp']['command']['update']['update'][:id]
@contact = Contact.where(code: code).first @contact = Contact.where(code: code).first
if rights? && stamp(@contact) && @contact.update_attributes(contact_and_address_attributes(:update)) if owner? && stamp(@contact) && @contact.update_attributes(contact_and_address_attributes(:update))
render 'epp/contacts/update' render 'epp/contacts/update'
else else
contact_exists?(code) contact_exists?(code)
@ -21,6 +21,7 @@ module Epp::ContactsHelper
def delete_contact def delete_contact
Contact.transaction do Contact.transaction do
@contact = find_contact @contact = find_contact
handle_errors(@contact) and return unless owner?
handle_errors(@contact) and return unless @contact handle_errors(@contact) and return unless @contact
handle_errors(@contact) and return unless @contact.destroy_and_clean handle_errors(@contact) and return unless @contact.destroy_and_clean
@ -111,8 +112,15 @@ module Epp::ContactsHelper
contact contact
end end
def owner?
return false unless find_contact
return true if current_epp_user.registrar == find_contact.created_by.try(:registrar)
epp_errors << { code: '2201', msg: t('errors.messages.epp_authorization_error') }
false
end
def rights? def rights?
pw = @ph.try(:[], :authInfo).try(:[], :pw) || @ph.try(:[], :chg).try(:[], :authInfo).try(:[], :pw) || [] pw = @ph.try(:[], :authInfo).try(:[], :pw)
return true if !find_contact.nil? && find_contact.auth_info_matches(pw) return true if !find_contact.nil? && find_contact.auth_info_matches(pw)

10
spec/epp/contact_spec.rb
View file

@ -102,7 +102,7 @@ describe 'EPP Contact', epp: true do
end end
it 'stamps updated_by succesfully' do it 'stamps updated_by succesfully' do
Fabricate(:contact, code: 'sh8013') Fabricate(:contact, code: 'sh8013', created_by_id: EppUser.first.id)
expect(Contact.first.updated_by_id).to be nil expect(Contact.first.updated_by_id).to be nil
@ -135,8 +135,8 @@ describe 'EPP Contact', epp: true do
end end
it 'updates disclosure items' do it 'updates disclosure items' do
Fabricate(:contact, code: 'sh8013', auth_info: '2fooBAR', Fabricate(:contact, code: 'sh8013', auth_info: '2fooBAR', created_by_id: EppUser.first.id,
disclosure: Fabricate(:contact_disclosure, phone:true, email:true)) disclosure: Fabricate(:contact_disclosure, phone: true, email: true))
epp_request('contacts/update.xml') epp_request('contacts/update.xml')
expect(Contact.last.disclosure.phone).to eq(false) expect(Contact.last.disclosure.phone).to eq(false)
@ -155,7 +155,7 @@ describe 'EPP Contact', epp: true do
end end
it 'deletes contact' do it 'deletes contact' do
Fabricate(:contact, code: 'dwa1234') Fabricate(:contact, code: 'dwa1234', created_by_id: EppUser.first.id)
response = epp_request('contacts/delete.xml') response = epp_request('contacts/delete.xml')
expect(response[:result_code]).to eq('1000') expect(response[:result_code]).to eq('1000')
expect(response[:msg]).to eq('Command completed successfully') expect(response[:msg]).to eq('Command completed successfully')
@ -171,7 +171,7 @@ describe 'EPP Contact', epp: true do
end end
it 'fails if contact has associated domain' do it 'fails if contact has associated domain' do
Fabricate(:domain, owner_contact: Fabricate(:contact, code: 'dwa1234')) Fabricate(:domain, owner_contact: Fabricate(:contact, code: 'dwa1234', created_by_id: EppUser.first.id))
expect(Domain.first.owner_contact.address.present?).to be true expect(Domain.first.owner_contact.address.present?).to be true
response = epp_request('contacts/delete.xml') response = epp_request('contacts/delete.xml')