tree c2a51e714eb78ef1b530b6b43ee7cc8c6f2baae0
parent 7e56f9f7859c8eee050964837c60a303a08dc6aa
author Edwin Kempin <ekempin@google.com> 1620730502 +0000
committer Edwin Kempin <ekempin@google.com> 1620836823 +0000

ListAccess: Fail for non-visible projects

ListAccess allows to specify a list of projects via request parameters
but it wasn't checked whether these projects are visible. This allowed
users to probe whether a project exists.

If a project is not visible we return the same error message as for a
non-existing project so that users cannot probe the existence of a
project.

In contrast to ListAccess GetAccess doesn't need to do the permission
check as it is already done by ProjectsCollection#parse which is
invoked before GetAccess is invoked if a REST call is done for a single
project.

Signed-off-by: Edwin Kempin <ekempin@google.com>
Change-Id: I76de47b097d18a6c2f4cd42650aa05a51094b839