From eac1ddc8d43ce16f3a47c30c548b8a5b50ed3ccd Mon Sep 17 00:00:00 2001 From: Prasanna Dangalla Date: Fri, 9 Jun 2023 13:11:41 +0530 Subject: [PATCH] Fix for to block getting same app response when its created previuosly. --- .../dcr/web/impl/RegistrationServiceImpl.java | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/components/apimgt/org.wso2.carbon.apimgt.rest.api.dcr/src/main/java/org/wso2/carbon/apimgt/rest/api/dcr/web/impl/RegistrationServiceImpl.java b/components/apimgt/org.wso2.carbon.apimgt.rest.api.dcr/src/main/java/org/wso2/carbon/apimgt/rest/api/dcr/web/impl/RegistrationServiceImpl.java index ebc5ec0d3eb2..169759d1e114 100644 --- a/components/apimgt/org.wso2.carbon.apimgt.rest.api.dcr/src/main/java/org/wso2/carbon/apimgt/rest/api/dcr/web/impl/RegistrationServiceImpl.java +++ b/components/apimgt/org.wso2.carbon.apimgt.rest.api.dcr/src/main/java/org/wso2/carbon/apimgt/rest/api/dcr/web/impl/RegistrationServiceImpl.java @@ -200,11 +200,22 @@ public Response register(RegistrationProfile profile) { (RestApiConstants.STATUS_BAD_REQUEST_MESSAGE_DEFAULT, 500L, errorMsg); response = Response.status(Response.Status.INTERNAL_SERVER_ERROR). entity(errorDTO).build(); - } else { + } else if ((authUserName.equals(returnedAPP.getAppOwner())) || + (isUserSuperAdmin(authUserName) && owner != null && owner.equals(returnedAPP.getAppOwner()))) { + // Permitting only the owner of the application to create/get the OAuth app and admin user to + // create/get the app info if the created app owner equals the payload app owner. if (log.isDebugEnabled()) { log.debug("OAuth app " + profile.getClientName() + " creation successful."); } response = Response.status(Response.Status.OK).entity(returnedAPP).build(); + } else { + String errMsg = "Access is forbidden to the application"; + if (log.isDebugEnabled()) { + log.debug("OAuth app owner: " + returnedAPP.getAppOwner() + " is different from payload " + + "owner: " + owner + " and " + errMsg); + } + errorDTO = RestApiUtil.getErrorDTO(RestApiConstants.STATUS_FORBIDDEN_MESSAGE_DEFAULT, 403L, errMsg); + response = Response.status(Response.Status.FORBIDDEN).entity(errorDTO).build(); } } else { String errorMsg = "Logged in user '" + authUserName + "' and application owner '" + @@ -262,8 +273,9 @@ private OAuthApplicationInfo getExistingApp(String applicationName, boolean saas appToReturn = this.fromAppDTOToApplicationInfo(consumerAppDTO.getOauthConsumerKey(), consumerAppDTO.getApplicationName(), consumerAppDTO.getCallbackUrl(), - consumerAppDTO.getOauthConsumerSecret(), saasApp, null, consumerAppDTO.getTokenType(), valueMap); - + consumerAppDTO.getOauthConsumerSecret(), saasApp, MultitenantUtils + .getTenantAwareUsername(consumerAppDTO.getUsername()), consumerAppDTO.getTokenType(), + valueMap); } catch (IdentityOAuthAdminException e) { log.error("error occurred while trying to get OAuth Application data", e); }