tree f4bfbca0565d017deb1cfdaa1335390b32de97bd
parent 65b473790d72ca204b2311da3fd2aa779f2a9274
author Edwin Kempin <ekempin@google.com> 1676565912 +0100
committer Edwin Kempin <ekempin@google.com> 1676881126 +0100

Check permissions when resolving accounts by secondary emails

The ByEmail searcher in AccountResolver resolved secondary emails
without checking whether the user has the Modify Account capability that
is required for being able to see secondary emails of other users.

Due to this it was possible to:
* Resolve a non-visible secondary email through the accounts API, e.g.:
  GET /accounts/<seondary-email>/detail
* Query changes by a non-visible secondary email, e.g query changes that
  are owned/uploaded/reviewed by the account that owns the secondary
  email.

The visibility of the resolved accounts is checked in both cases, so
resolving a non-visible secondary email only worked when the account
owning it was visible.

A partial fix for the same issue had already been done by change
Ic0f36127a, but this fix missed to check the permission in the ByEmail
searcher (the ByEmail searcher is only used if the input contains '@',
hence the tests that were added by the fix change didn't catch this).

With this change AccountResolver resolves secondary emails for other
accounts only if the user has the Modify Account capability. Secondary
emails of the own account are always visible and hence always resolved.

Release-Notes: Check permissions when resolving accounts by secondary emails
Signed-off-by: Edwin Kempin <ekempin@google.com>
Change-Id: I799bf1c57eb84549cba6d7ff462c04cef90fc63b
Signed-off-by: Edwin Kempin <ekempin@google.com>