Revision c8860319

b/docs/pithos-api-guide.rst
27 27
=========================  ================================
28 28
Revision                   Description
29 29
=========================  ================================
30
0.14 (Jun 18, 2013)        Forbidden response for public listing by non path owners
30 31
0.13 (Mar 27, 2013)        Restrict public object listing only to the owner.
31
                           Do not propagate public URL information in shared objects.
32
\                          Do not propagate public URL information in shared objects.
32 33
0.13 (Jan 21, 2013)        Proxy identity management services
33 34
\                          UUID to displayname translation
34 35
0.9 (Feb 17, 2012)         Change permissions model.
......
427 428
200 (OK)                     The request succeeded
428 429
204 (No Content)             The account has no containers (only for non-extended replies)
429 430
304 (Not Modified)           The account has not been modified
431
403 (Forbidden)              Public is requested but the request user is not the path owner
430 432
412 (Precondition Failed)    The condition set can not be satisfied
431 433
===========================  =====================
432 434

  
......
545 547
format                  Optional extended reply type (can be ``json`` or ``xml``)
546 548
meta                    Return objects that satisfy the key queries in the specified comma separated list (use ``<key>``, ``!<key>`` for existence queries, ``<key><op><value>`` for value queries, where ``<op>`` can be one of ``=``, ``!=``, ``<=``, ``>=``, ``<``, ``>``)
547 549
shared                  Show only objects (no value parameter)
548
public                  Show only public objects (no value parameter / avalaible only for owner reqeusts)
550
public                  Show only public objects (no value parameter / avalaible only for owner requests)
549 551
until                   Optional timestamp
550 552
======================  ===================================
551 553

  
......
637 639
200 (OK)                     The request succeeded
638 640
204 (No Content)             The account has no containers (only for non-extended replies)
639 641
304 (Not Modified)           The container has not been modified
642
403 (Forbidden)              Public is requested but the request user is not the path owner
640 643
412 (Precondition Failed)    The condition set can not be satisfied
641 644
===========================  ===============================
642 645

  
b/snf-pithos-app/pithos/api/functions.py
376 376
    shared = False
377 377
    if 'shared' in request.GET:
378 378
        shared = True
379
    public = False
380
    if request.user_uniq == v_account and 'public' in request.GET:
381
        public = True
379

  
380
    public_requested = 'public' in request.GET
381
    public_granted = public_requested and request.user_uniq == v_account
382

  
383
    if public_requested and not public_granted:
384
        raise faults.Forbidden(
385
            'PUblic container listing is not allowed to non path owners')
382 386

  
383 387
    try:
384 388
        containers = request.backend.list_containers(
385 389
            request.user_uniq, v_account,
386
            marker, limit, shared, until, public)
390
            marker, limit, shared, until, public_granted)
387 391
    except NotAllowedError:
388 392
        raise faults.Forbidden('Not allowed')
389 393
    except NameError:
......
662 666
    public_requested = 'public' in request.GET
663 667
    public_granted = public_requested and request.user_uniq == v_account
664 668

  
669
    if public_requested and not public_granted:
670
        raise faults.Forbidden(
671
            'PUblic object listing is not allowed to non path owners')
672

  
665 673
    if request.serialization == 'text':
666 674
        try:
667 675
            objects = request.backend.list_objects(

Also available in: Unified diff