datopian / datahub-qa

:package: Bugs, issues and suggestions for datahub.io
https://datahub.io/
32 stars 6 forks source link

[push] Define owner and ownerid on the server side. #186

Closed AcckiyGerman closed 8 months ago

AcckiyGerman commented 6 years ago

https://github.com/datahq/data-cli/blob/a0eb8458feb8cec5c0d62b2f676a7ecf0b939a0e/bin/data-push.js#L90

const datahubConfigs = {
      token: config.get('token'),
      ...
      ownerid: config.get('profile') ? config.get('profile').id : config.get('id'),
      owner: config.get('profile') ? config.get('profile').username : config.get('username')
    }

I tried to provide fake ownerid or owner from some other user and I've got

It looks like the server is secured. But anyway the owner and ownerid info could be inferred on the server-side (and it does happen when server do security check), so let's do it there and remove this code as redundant in the data-cli.

Tasks

Related issues

https://github.com/datahq/data-cli/issues/233