MyData: fails silently if non-superuser calls api with otherUserId
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.1k
- Forks
- 564
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 29
Description
The MyData endpoint has a param, 'userIdentifier' that can be used to get the results of another user other than the caller of the API. This feature is only available for superusers. If non-superuser includes another userIdentifier, it is ignored, and the calling user's results are returned.
What steps does it take to reproduce the issue?
Call the MyData endpoint as a non-super user, and include the userIdentifer param with another user name.
-
What happens?
The calling user's data is returned. -
To whom does it occur (all users, curators, superusers)?
all non-super users -
What did you expect to happen?
It should return an error saying the request is not authorized
Which version of Dataverse are you using?
6.6
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the MyData API endpoint and the handling of its userIdentifier parameter, then reproduce the request as a non-superuser with another user's identifier. Trace where authorization is checked and confirm that the completed behavior rejects that request instead of returning the caller's data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100