)]}'
{"tests/test_v3_identity.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a6594feafd0a773d0f3439f665ba0d86dd9e8628","unresolved":false,"context_lines":[{"line_number":382,"context_line":"            password\u003dself.user2[\u0027password\u0027])"},{"line_number":383,"context_line":"        r \u003d self.get(\u0027/users/%(user_id)s/groups\u0027 % {"},{"line_number":384,"context_line":"            \u0027user_id\u0027: self.user1[\u0027id\u0027]}, auth\u003dauth,"},{"line_number":385,"context_line":"            expected_status\u003dexception.ForbiddenAction.code)"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    def test_check_user_in_group(self):"},{"line_number":388,"context_line":"        \"\"\"HEAD /groups/{group_id}/users/{user_id}\"\"\""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAOn%2F%2F2gc%3D","line":385,"updated":"2013-04-17 18:34:15.000000000","message":"should this return NotFound? What grants user2 authority to know that user1 exists?","commit_id":"12f6eb886a46f6b9dd5e021361297d6bb3a66230"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c6e59b8761f136542c3cc10444f7aa1687b9bded","unresolved":false,"context_lines":[{"line_number":382,"context_line":"            password\u003dself.user2[\u0027password\u0027])"},{"line_number":383,"context_line":"        r \u003d self.get(\u0027/users/%(user_id)s/groups\u0027 % {"},{"line_number":384,"context_line":"            \u0027user_id\u0027: self.user1[\u0027id\u0027]}, auth\u003dauth,"},{"line_number":385,"context_line":"            expected_status\u003dexception.ForbiddenAction.code)"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    def test_check_user_in_group(self):"},{"line_number":388,"context_line":"        \"\"\"HEAD /groups/{group_id}/users/{user_id}\"\"\""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAOn%2F%2FysE%3D","line":385,"in_reply_to":"AAAAOn%2F%2F2gc%3D","updated":"2013-04-23 08:20:51.000000000","message":"I think the rationale is that if you did return NotFound, then this would be a way of users trolling to find out valid userIDs...returning ForbiddenAction stops this leakage","commit_id":"12f6eb886a46f6b9dd5e021361297d6bb3a66230"},{"author":{"_account_id":7135,"name":"Liang Chen","email":"liangchen.linux@gmail.com","username":"Liang"},"change_message_id":"e4f75771c58b2c32fa2986f68f9e486ba3225676","unresolved":false,"context_lines":[{"line_number":382,"context_line":"            password\u003dself.user2[\u0027password\u0027])"},{"line_number":383,"context_line":"        r \u003d self.get(\u0027/users/%(user_id)s/groups\u0027 % {"},{"line_number":384,"context_line":"            \u0027user_id\u0027: self.user1[\u0027id\u0027]}, auth\u003dauth,"},{"line_number":385,"context_line":"            expected_status\u003dexception.ForbiddenAction.code)"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    def test_check_user_in_group(self):"},{"line_number":388,"context_line":"        \"\"\"HEAD /groups/{group_id}/users/{user_id}\"\"\""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAOn%2F%2F2Nc%3D","line":385,"in_reply_to":"AAAAOn%2F%2F2gc%3D","updated":"2013-04-18 02:57:05.000000000","message":"user2 will not know the existence of user1. Because it always returns 403 no matter the user_id exists or not.","commit_id":"12f6eb886a46f6b9dd5e021361297d6bb3a66230"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c6e59b8761f136542c3cc10444f7aa1687b9bded","unresolved":false,"context_lines":[{"line_number":383,"context_line":"        r \u003d self.get(\u0027/users/%(user_id)s/groups\u0027 % {"},{"line_number":384,"context_line":"            \u0027user_id\u0027: self.user1[\u0027id\u0027]}, auth\u003dauth,"},{"line_number":385,"context_line":"            expected_status\u003dexception.ForbiddenAction.code)"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    def test_check_user_in_group(self):"},{"line_number":388,"context_line":"        \"\"\"HEAD /groups/{group_id}/users/{user_id}\"\"\""},{"line_number":389,"context_line":"        self.put(\u0027/groups/%(group_id)s/users/%(user_id)s\u0027 % {"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAOn%2F%2Fyro%3D","line":386,"updated":"2013-04-23 08:20:51.000000000","message":"My only comment is that the fact that one user cannot see another user\u0027s groups is purely a function of a particularly policy file (albeit the default is setup this way).  It might be good to mention this as a comment in case we ever change this default in the future","commit_id":"12f6eb886a46f6b9dd5e021361297d6bb3a66230"},{"author":{"_account_id":7135,"name":"Liang Chen","email":"liangchen.linux@gmail.com","username":"Liang"},"change_message_id":"815e873ebab8e14d9e7e44b55d7488945d49bb01","unresolved":false,"context_lines":[{"line_number":383,"context_line":"        r \u003d self.get(\u0027/users/%(user_id)s/groups\u0027 % {"},{"line_number":384,"context_line":"            \u0027user_id\u0027: self.user1[\u0027id\u0027]}, auth\u003dauth,"},{"line_number":385,"context_line":"            expected_status\u003dexception.ForbiddenAction.code)"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    def test_check_user_in_group(self):"},{"line_number":388,"context_line":"        \"\"\"HEAD /groups/{group_id}/users/{user_id}\"\"\""},{"line_number":389,"context_line":"        self.put(\u0027/groups/%(group_id)s/users/%(user_id)s\u0027 % {"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAOn%2F%2Fyp4%3D","line":386,"in_reply_to":"AAAAOn%2F%2Fyro%3D","updated":"2013-04-23 08:45:38.000000000","message":"Yup, feel the same way","commit_id":"12f6eb886a46f6b9dd5e021361297d6bb3a66230"}]}