[jira] [Created] (RAVE-814) WidgetApi doesn't properly validate widget ID when dealing with subordinate objects

["Chris Geer (JIRA)" <ji...@apache.org>]

Chris Geer created RAVE-814:
-------------------------------

             Summary: WidgetApi doesn't properly validate widget ID when dealing with subordinate objects
                 Key: RAVE-814
                 URL: https://issues.apache.org/jira/browse/RAVE-814
             Project: Rave
          Issue Type: Bug
            Reporter: Chris Geer
            Priority: Minor


When getting/updating widget comments (and other objects) the widget ID isn't validated. For example, if you have a widget with ID 2 and a comment with ID 7 you should be able to update that comment with this url:

http://localhost:8080/portal/app/api/rest/widgets/2/comments/7?text=update

That path works great but the problem is that is you use this path (Widget ID 999999) it also works

http://localhost:8080/portal/app/api/rest/widgets/999999/comments/7?text=shouldntupdate

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira