dlr-eoc / prosEO

prosEO – A Processing System for Earth Observation Data
GNU General Public License v3.0
14 stars 1 forks source link

[prosEO CLI] {product create} should be not allowed if the user is not logged in #30

Closed dlr-tangosierra closed 4 years ago

dlr-tangosierra commented 4 years ago

Testing parameters: User Login: no user login Mission : no mission

Context: When the user executes the command product create, the system returns that the user is not logged but then allows the user to enter mandatory attributes. On top of that, there seems to be a security concern when the system gets the final input attribute: the HTTP request seems to be actually sent with no response but also no explanation on what went wrong.

It is a security concern and should not be allowed to enter the attributes if the users are not logged in. The system should return to the default prompt if the user is not loggen in returning a relevant message for the need of logging in.

Example output: prosEO> product create (E2802) User not logged in Checking for missing mandatory attributes ... Product class (empty field cancels): abc File class (empty field cancels): abc Sensing start time (empty field cancels): 2020-02-01T14:00:00 Sensing stop time (empty field cancels): 2020-02-01T14:50:00 Product generation time (empty field cancels): 2020-02-01T14:52:00 (E2806) Command failed (cause: (E2810) HTTP request failed (cause: Could not extract response: no suitable HttpMessageConverter found for response type [class de.dlr.proseo.model.rest.model.RestProduct] and content type [text/html]); nested exception is org.springframework.web.client.RestClientException: Could not extract response: no suitable HttpMessageConverter found for response type [class de.dlr.proseo.model.rest.model.RestProduct] and content type [text/html]) prosEO>

Similarly with the command [productclass create]: prosEO> productclass create (E2802) User not logged in Checking for missing mandatory attributes ... Product class name (empty field cancels): abc Mission product type (empty field cancels): abc (E2806) Command failed (cause: (E2810) HTTP request failed (cause: Could not extract response: no suitable HttpMessageConverter found for response type [class de.dlr.proseo.model.rest.model.RestProductClass] and content type [text/html]); nested exception is org.springframework.web.client.RestClientException: Could not extract response: no suitable HttpMessageConverter found for response type [class de.dlr.proseo.model.rest.model.RestProductClass] and content type [text/html])

tangobravo62 commented 4 years ago

Fixed:

prosEO> product create
(E2802) User not logged in
prosEO> productclass create
(E2802) User not logged in
prosEO>