[#11586] Remove trailing @gmail.com when checking for user ID equal…

…ity (#11923)
TEAMMATES · Aug 3, 2022 · 3155a78 · 3155a78
1 parent 604d4de
commit 3155a78
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 5 deletions.
diff --git a/src/main/java/teammates/ui/webapi/Action.java b/src/main/java/teammates/ui/webapi/Action.java
@@ -91,7 +91,8 @@ public void setLogsProcessor(LogsProcessor logsProcessor) {
      */
     public void checkAccessControl() throws UnauthorizedAccessException {
         String userParam = getRequestParamValue(Const.ParamsNames.USER_ID);
-        if (userInfo != null && userParam != null && !userInfo.isAdmin && !userInfo.id.equals(userParam)) {
+        if (userInfo != null && userParam != null && !userInfo.isAdmin
+                && !userInfo.id.replaceFirst("@gmail.com$", "").equals(userParam.replaceFirst("@gmail.com$", ""))) {
             throw new UnauthorizedAccessException("User " + userInfo.id
                     + " is trying to masquerade as " + userParam + " without admin permission.");
         }

diff --git a/src/main/java/teammates/ui/webapi/BasicFeedbackSubmissionAction.java b/src/main/java/teammates/ui/webapi/BasicFeedbackSubmissionAction.java
@@ -84,7 +84,8 @@ void checkAccessControlForStudentFeedbackSubmission(
                 if (userInfo == null) {
                     // Student is associated to a google ID; even if registration key is passed, do not allow access
                     throw new UnauthorizedAccessException("Login is required to access this feedback session");
-                } else if (!userInfo.id.equals(student.getGoogleId())) {
+                } else if (!userInfo.id.replaceFirst("@gmail.com$", "")
+                        .equals(student.getGoogleId().replaceFirst("@gmail.com$", ""))) {
                     // Logged in student is not the same as the student registered for the given key, do not allow access
                     throw new UnauthorizedAccessException("You are not authorized to access this feedback session");
                 }
@@ -134,7 +135,8 @@ void checkAccessControlForInstructorFeedbackSubmission(
                 if (userInfo == null) {
                     // Instructor is associated to a google ID; even if registration key is passed, do not allow access
                     throw new UnauthorizedAccessException("Login is required to access this feedback session");
-                } else if (!userInfo.id.equals(instructor.getGoogleId())) {
+                } else if (!userInfo.id.replaceFirst("@gmail.com$", "")
+                        .equals(instructor.getGoogleId().replaceFirst("@gmail.com$", ""))) {
                     // Logged in instructor is not the same as the instructor registered for the given key,
                     // do not allow access
                     throw new UnauthorizedAccessException("You are not authorized to access this feedback session");

diff --git a/src/main/java/teammates/ui/webapi/DeleteStudentProfilePictureAction.java b/src/main/java/teammates/ui/webapi/DeleteStudentProfilePictureAction.java
@@ -18,7 +18,7 @@ void checkSpecificAccessControl() throws UnauthorizedAccessException {
             throw new UnauthorizedAccessException("Student privilege is required to update this resource.");
         }
         String googleId = getNonNullRequestParamValue(Const.ParamsNames.STUDENT_ID);
-        if (!userInfo.id.equals(googleId)) {
+        if (!userInfo.id.replaceFirst("@gmail.com$", "").equals(googleId.replaceFirst("@gmail.com$", ""))) {
             throw new UnauthorizedAccessException("You are not authorized to delete this student's profile.");
         }
     }

diff --git a/src/main/java/teammates/ui/webapi/GetRegkeyValidityAction.java b/src/main/java/teammates/ui/webapi/GetRegkeyValidityAction.java
@@ -57,7 +57,8 @@ public JsonResult execute() {
                 isUsed = true;
                 // If the registration key has been used to register, the logged in user needs to match
                 // Block access to not logged in user and mismatched user
-                isAllowedAccess = userInfo != null && googleId.equals(userInfo.id);
+                isAllowedAccess = userInfo != null && googleId.replaceFirst("@gmail.com$", "")
+                        .equals(userInfo.id.replaceFirst("@gmail.com$", ""));
             }
         }