Re: Change error code from 405 to 400 for invalid props to @fields/@attrs

On Tue, Dec 07, 2021 at 01:23:13AM -0500, John P. Rouillard wrote:
> 
> Since this changes the return code I wonder if I can push it without
> bumping the rest version. I figure there are very few users but...

Fine with me if you push this.

> Also a filter like:
> 
>    issu3?status.nam=o
> 
> returns a 403 forbidden error (User does not have search permission on
> "issue.status.nam") not a 400 bad request. I think this needs fixing
> too. (This can be handled by adding a call to transitive_props().)

Is this for a non-existing property nam or is it actually a permission
error? And it might be good security practice to not disclose if the
property does not exist of if the user doesn't have permission?

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]