TheHive-Project / TheHive-Project/Cortex
[API] A DELETE request to a non-existing organisation disables the user that has the same id
Open
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Ubuntu |
| OS version (client) | Ubuntu |
| Cortex version / git hash | 3.0.1-1 |
| Package Type | From source |
| Browser type & version | REST API |
Problem Description
When I make a request to /api/organization/ORG_ID to a non-existing organization, it disables the user whose id is ORG_ID.
Steps to Reproduce
Create an user named "test".
Send a DELETE request to /api/organization/test
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the DELETE request against /api/organization/{ORG_ID} from the issue's steps, then trace the REST API handler for organization deletion. Done means deleting a nonexistent organization no longer disables a user with the same id, while valid organization deletion still behaves correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100