Merge "Fix sql injection vulnerability"

[portal.git] / ecomp-portal-FE-common / client / app / services / users / users.service.js

diff --git a/ecomp-portal-FE-common/client/app/services/users/users.service.js b/ecomp-portal-FE-common/client/app/services/users/users.service.js
index 808a663..045c674 100644 (file)
--- a/ecomp-portal-FE-common/client/app/services/users/users.service.js
+++ b/ecomp-portal-FE-common/client/app/services/users/users.service.js
@@ -1,21 +1,39 @@
 /*-
- * ================================================================================
- * ECOMP Portal
- * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
+ * ============LICENSE_START==========================================
+ * ONAP Portal
+ * ===================================================================
+ * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
  * You may obtain a copy of the License at
- * 
- *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
+ *             http://www.apache.org/licenses/LICENSE-2.0
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- * ================================================================================
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *             https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * 
  */
 /**
  * Created by doritrieur on 12/8/15.
@@ -113,7 +131,7 @@
             return deferred.promise;
         }
 
-        getUserAppRoles(appid, orgUserId, extRequestValue){
+        getUserAppRoles(appid, orgUserId, extRequestValue,isSystemUser){
                let canceller = this.$q.defer();
             let isActive = false;
 
@@ -130,7 +148,7 @@
             this.$http({
                 method: 'GET',
                 url: this.conf.api.userAppRoles,
-                params: {user: orgUserId, app: appid, externalRequest: extRequestValue},
+                params: {user: orgUserId, app: appid, externalRequest: extRequestValue,isSystemUser: isSystemUser},
                 cache: false,
                 headers: {
                     'X-ECOMP-RequestID':this.uuid.generate()
@@ -182,8 +200,8 @@
             }).then( res => {
                 // this.$log.debug('getUserAppRoles response: ', JSON.stringify(res))
                 // If response comes back as a redirected HTML page which IS NOT a success
-                if (this.utilsService.isValidJSON(res)== false) {
-                    deferred.reject('UsersService::updateUserAppRoles: Failed');
+                if (this.utilsService.isValidJSON(res)== false ||  res.data.httpStatusCode == '500' || res.data.status == 'ERROR') {
+                    deferred.reject('UsersService::updateUserAppRoles: Failed'  + res.data.message);
                 } else {
                     // this.$log.info('UsersService::updateUserAppRoles: Succeeded');
                     deferred.resolve(res.data);