Merge branch 'master' of github.com:internetee/registry

Conflicts:
	spec/epp/contact_spec.rb

app/helpers/epp/contacts_helper.rb

@@ -1,18 +1,15 @@
 module Epp::ContactsHelper
   def create_contact
     @contact = Contact.new( contact_and_address_attributes )
-    stamp @contact
-    if @contact.save
-      render '/epp/contacts/create'
-    else
-      handle_errors(@contact)
-    end
+    render '/epp/contacts/create' and return if stamp(@contact) && @contact.save
+
+    handle_errors(@contact)
   end
 
   def update_contact
     code = params_hash['epp']['command']['update']['update'][:id]
     @contact = Contact.where(code: code).first
-    if stamp(@contact) && @contact.update_attributes(contact_and_address_attributes(:update))
+    if has_rights? && stamp(@contact) && @contact.update_attributes(contact_and_address_attributes(:update))
       render 'epp/contacts/update'
     else
       epp_errors << { code: '2303', msg: t('errors.messages.epp_obj_does_not_exist'), value: { obj: 'id', val: code } } if @contact == []
@@ -22,6 +19,7 @@ module Epp::ContactsHelper
 
   def delete_contact
     #no deleting, implement PaperTrail or something similar. 
+    #TODO check for relation before 'destroying'
     @contact = find_contact
     handle_errors(@contact) and return unless @contact
     @contact.destroy
@@ -35,6 +33,7 @@ module Epp::ContactsHelper
   end
 
   def info_contact
+    handle_errors and return unless has_rights?
     @contact = find_contact
     handle_errors(@contact) and return unless @contact
     render 'epp/contacts/info'
@@ -47,12 +46,10 @@ module Epp::ContactsHelper
   def validate_contact_create_request
     @ph = params_hash['epp']['command']['create']['create']
     xml_attrs_present?(@ph, [['id'], 
-                             ['postalInfo'], 
+                             ['authInfo', 'pw'],
                              ['postalInfo', 'name'], 
-                             ['postalInfo', 'addr'],
                              ['postalInfo', 'addr', 'city'], 
-                             ['postalInfo', 'addr', 'cc'], 
-                             ['authInfo']])
+                             ['postalInfo', 'addr', 'cc']])
   end
   
   ## UPDATE
@@ -89,6 +86,15 @@ module Epp::ContactsHelper
     contact
   end
 
+  def has_rights?
+    pw = @ph.try(:[], :authInfo).try(:[], :pw) || @ph.try(:[], :chg).try(:[], :authInfo).try(:[], :pw) || []
+    id = @ph[:id]
+
+    return true if ( !find_contact.nil? && find_contact.auth_info_matches(pw) )
+
+    epp_errors << { code: '2201', msg: t('errors.messages.epp_authorization_error'), value: { obj: 'pw', val: pw } }
+    return false
+  end
 
   def contact_and_address_attributes( type=:create )
     case type
@@ -105,13 +111,6 @@ module Epp::ContactsHelper
     contact_hash
   end
 
-  def has_rights
-    if @contact.created_by.registrar == current_epp_user.registrar
-      return true
-    end
-    return false
-  end
-
   def ident_type
     result = params[:frame].slice(/(?<=\<ns2:ident type=)(.*)(?=<)/)
 

app/models/contact.rb

@@ -66,6 +66,11 @@ class Contact < ActiveRecord::Base
     updated_by ? updated_by.username : nil
   end
 
+  def auth_info_matches pw
+    return true if auth_info == pw
+    return false
+  end
+
   class << self
 
     def extract_attributes ph, type=:create