From 880754877d106e17e80c6425247a93c90d746442 Mon Sep 17 00:00:00 2001 From: Johannes Zellner Date: Thu, 9 Jun 2016 14:44:38 +0200 Subject: [PATCH] Prevent the rest api to delete addon auth clients --- src/routes/clients.js | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/routes/clients.js b/src/routes/clients.js index 267e5594c..ac5bce5e1 100644 --- a/src/routes/clients.js +++ b/src/routes/clients.js @@ -48,11 +48,19 @@ function get(req, res, next) { function del(req, res, next) { assert.strictEqual(typeof req.params.clientId, 'string'); - clients.del(req.params.clientId, function (error, result) { + clients.get(req.params.clientId, function (error, result) { if (error && error.reason === DatabaseError.NOT_FOUND) return next(new HttpError(404, 'no such client')); - if (error && error.reason === ClientsError.NOT_ALLOWED) return next(new HttpError(405, error.message)); if (error) return next(new HttpError(500, error)); - next(new HttpSuccess(204, result)); + + // we do not allow to use the REST API to delete addon clients + if (result.type !== clients.TYPE_EXTERNAL) return next(new HttpError(405, 'Deleting app addon clients is not allowed.')); + + clients.del(req.params.clientId, function (error, result) { + if (error && error.reason === DatabaseError.NOT_FOUND) return next(new HttpError(404, 'no such client')); + if (error && error.reason === ClientsError.NOT_ALLOWED) return next(new HttpError(405, error.message)); + if (error) return next(new HttpError(500, error)); + next(new HttpSuccess(204, result)); + }); }); }