SONAR-11723 Prevent updating attributes of non-local users

diff --git a/server/sonar-server/src/main/java/org/sonar/server/user/ws/UpdateAction.java b/server/sonar-server/src/main/java/org/sonar/server/user/ws/UpdateAction.java
index b40b8659275d110adf4ba482d17b9e1a47aedb7d..b71f3fe2f49fd9c72f102667d465541b675f087f 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/user/ws/UpdateAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/user/ws/UpdateAction.java
@@ -25,6 +25,7 @@ import java.util.List;
 import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
+import org.sonar.api.internal.google.common.base.Preconditions;
 import org.sonar.api.server.ws.Change;
 import org.sonar.api.server.ws.Request;
 import org.sonar.api.server.ws.Response;
@@ -126,9 +127,11 @@ public class UpdateAction implements UsersWsAction {
     UserDto user = getUser(dbSession, login);
     UpdateUser updateUser = new UpdateUser();
     if (request.getName() != null) {
+      Preconditions.checkArgument(user.isLocal(), "Name cannot be updated for a non-local user");
       updateUser.setName(request.getName());
     }
     if (request.getEmail() != null) {
+      Preconditions.checkArgument(user.isLocal(), "Email cannot be updated for a non-local user");
       updateUser.setEmail(emptyToNull(request.getEmail()));
     }
     if (!request.getScmAccounts().isEmpty()) {

diff --git a/server/sonar-server/src/test/java/org/sonar/server/user/ws/UpdateActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/user/ws/UpdateActionTest.java
index efab9c999c068185bcfad3b6645d722a3b3b2357..8901a4c7dd518af87e740bb4dd04a54e17361a8a 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/user/ws/UpdateActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/user/ws/UpdateActionTest.java
@@ -97,6 +97,32 @@ public class UpdateActionTest {
       .assertJson(getClass(), "update_user.json");
   }
 
+  @Test
+  public void fail_on_update_name_non_local_user() {
+    createUser(false);
+
+    expectedException.expect(IllegalArgumentException.class);
+    expectedException.expectMessage("Name cannot be updated for a non-local user");
+
+    ws.newRequest()
+      .setParam("login", "john")
+      .setParam("name", "Jean Neige")
+      .execute();
+  }
+
+  @Test
+  public void fail_on_update_email_non_local_user() {
+    createUser(false);
+
+    expectedException.expect(IllegalArgumentException.class);
+    expectedException.expectMessage("Email cannot be updated for a non-local user");
+
+    ws.newRequest()
+      .setParam("login", "john")
+      .setParam("email", "jean.neige@thegreatw.all")
+      .execute();
+  }
+
   @Test
   public void update_only_name() {
     createUser();
@@ -283,13 +309,17 @@ public class UpdateActionTest {
   }
 
   private void createUser() {
+    createUser(true);
+  }
+
+  private void createUser(boolean local) {
     UserDto userDto = newUserDto()
       .setEmail("john@email.com")
       .setLogin("john")
       .setName("John")
       .setScmAccounts(newArrayList("jn"))
       .setActive(true)
-      .setLocal(true)
+      .setLocal(local)
       .setExternalLogin("jo")
       .setExternalIdentityProvider("sonarqube");
     dbClient.userDao().insert(dbSession, userDto);

diff --git a/server/sonar-server/src/test/resources/org/sonar/server/user/ws/UpdateActionTest/update_scm_accounts.json b/server/sonar-server/src/test/resources/org/sonar/server/user/ws/UpdateActionTest/update_scm_accounts.json
index a95390694665b0edabf8b1f353642e999d6aaddb..445f1b29800b4cd5cd18c0d325115fb47d6c39dd 100644 (file)
--- a/server/sonar-server/src/test/resources/org/sonar/server/user/ws/UpdateActionTest/update_scm_accounts.json
+++ b/server/sonar-server/src/test/resources/org/sonar/server/user/ws/UpdateActionTest/update_scm_accounts.json
@@ -4,6 +4,10 @@
     "name": "John",
     "email": "john@email.com",
     "active": true,
+    "local": false,
+    "externalIdentity": "jo",
+    "externalProvider": "sonarqube",
+    "groups": [],
     "scmAccounts": [
       "jon.snow"
     ],