validateNewBody validates any new body being received (i.e. through blip, import, and API)
(body Body)
| 19 | |
| 20 | // validateNewBody validates any new body being received (i.e. through blip, import, and API) |
| 21 | func validateNewBody(body Body) error { |
| 22 | // Reject a body that contains the "_removed" property, this means that the user |
| 23 | // is trying to update a document they do not have read access to. |
| 24 | if body[BodyRemoved] != nil { |
| 25 | return base.HTTPErrorf(http.StatusNotFound, "Document revision is not accessible") |
| 26 | } |
| 27 | |
| 28 | // Reject bodies that contains the "_purged" property. |
| 29 | if _, ok := body[BodyPurged]; ok { |
| 30 | return base.HTTPErrorf(http.StatusBadRequest, "user defined top-level property '_purged' is not allowed in document body") |
| 31 | } |
| 32 | |
| 33 | for key := range body { |
| 34 | if strings.HasPrefix(key, BodyInternalPrefix) { |
| 35 | return base.HTTPErrorf(http.StatusBadRequest, "user defined top-level properties that start with '_sync_' are not allowed in document body") |
| 36 | } |
| 37 | } |
| 38 | return nil |
| 39 | } |
| 40 | |
| 41 | // validateAPIDocUpdate finds disallowed document properties that are allowed in through blip and/or import but not through |
| 42 | // the REST API |
no test coverage detected