Changeset 2293 for trunk/packages/invirt-web/code

Timestamp:

Apr 6, 2009, 10:13:53 PM (16 years ago)

Author:

broder

Message:

Fix a potential quota hole from cross-realm Hesiod entries.

File:

• trunk/packages/invirt-web/code/validation.py (modified) (1 diff)

trunk/packages/invirt-web/code/validation.py

@@ -242 +242 @@
     if owner is None:
         raise InvalidInput('owner', owner, "Owner must be specified")
+    if '@' in owner:
+        raise InvalidInput('owner', owner, "No cross-realm Hesiod lockers allowed")
     try:
         if user not in cache_acls.expandLocker(owner):