geonetwork / geonetwork/core-geonetwork

Html formatter error response for non allowed metadata

Open
#1,850 3 comments 0 reactions 1 assignee Claimed by @fxprunayre View on GitHub
question stale
Dominant language
Java
Stars
521
Forks
514
Avg merge
6d 13h
Merged PRs (30d)
19

Description

Actually the formatters return an `OperationNotAllowedEx` or `AccessDeniedException` exceptions (depending if the user is logged or not), see https://github.com/geonetwork/core-geonetwork/blob/develop/core/src/main/java/org/fao/geonet/lib/ResourceLib.java#L129-L135. This difference looks to me a bit bizarre, but ok.

The main issue is that returns a "text" exception, that can be ok if requesting xml or pdf, but for html I think would be better to redirect to the user to the login page if not authorised to access the current metadata. Similar stuff if metadata is not found to a 404 page, but I don't think we have such a page in the application.

I have done the following change to redirect to the login page for html formatter in case not authorised, updating the code in https://github.com/geonetwork/core-geonetwork/blob/develop/services/src/main/java/org/fao/geonet/api/records/formatters/FormatterApi.java#L427. Looks working fine, but would like to check for additional opinion about how to handle this.

```
try {
Lib.resource.checkPrivilege(context, resolvedId, ReservedOperation.view);
} catch (Exception e) {
if (formatType.equals(FormatType.html)) {
// Save Request for security redirect later
new HttpSessionRequestCache().saveRequest(
(HttpServletRequest) request.getNativeRequest(),
(HttpServletResponse) request.getNativeResponse());
// Commence authentication using login page
new LoginUrlAuthenticationEntryPoint("/signin").commence(
(HttpServletRequest) request.getNativeRequest(),
(HttpServletResponse) request.getNativeResponse(),
new InsufficientAuthenticationException("Full authentication required"));

return;
} else {
throw e;
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.