commit ff287268be95b114b1743f5b02e61fb8ad1025af
author Edwin Kempin <ekempin@google.com> Thu Apr 04 15:15:35 2019 +0200
committer Edwin Kempin <ekempin@google.com> Wed Apr 10 08:47:39 2019 +0200
tree f6b7a727231d7e9a97907cfa2dcf8960e15103d0
parent b218b4619502f75c452f794ab5ea1507656d4e81

PostCheck: Do permission checks first, then validate the input

This is the order that we follow in most REST endpoints.

Signed-off-by: Edwin Kempin <ekempin@google.com>
Change-Id: Ibf56826edcba55747e655f9ddbd05fec3a62b677
Signed-off-by: Edwin Kempin <ekempin@google.com>

java/com/google/gerrit/plugins/checks/api/PostCheck.java

diff --git a/java/com/google/gerrit/plugins/checks/api/PostCheck.java b/java/com/google/gerrit/plugins/checks/api/PostCheck.java
index 1a1d1c6..aba0995 100644
--- a/java/com/google/gerrit/plugins/checks/api/PostCheck.java
+++ b/java/com/google/gerrit/plugins/checks/api/PostCheck.java
@@ -76,6 +76,11 @@
   public CheckInfo apply(RevisionResource rsrc, CheckInput input)
       throws OrmException, IOException, RestApiException, PermissionBackendException,
           ConfigInvalidException {
+    if (!self.get().isIdentifiedUser()) {
+      throw new AuthException("Authentication required");
+    }
+    permissionBackend.currentUser().check(permission);
+
     if (input == null) {
       input = new CheckInput();
     }
@@ -86,11 +91,6 @@
       throw new BadRequestException(String.format("invalid checker UUID: %s", input.checkerUuid));
     }
 
-    if (!self.get().isIdentifiedUser()) {
-      throw new AuthException("Authentication required");
-    }
-    permissionBackend.currentUser().check(permission);
-
     CheckerUuid checkerUuid = CheckerUuid.parse(input.checkerUuid);
 
     CheckKey key = CheckKey.create(rsrc.getProject(), rsrc.getPatchSet().getId(), checkerUuid);