Reject invalid HTTPBasicAuth PATCH values
An unsupported HTTPBasicAuth value set a PropertyValueNotInList error
and then fell through, so handleAccountServicePatch continued on to
apply every other property in the request body. The client sees 400,
which means the request was not processed, while properties were in
fact written and persisted. A PATCH of
{"HTTPBasicAuth": "Unadvertised",
"Oem": {"OpenBMC": {"AuthMethods": {"BasicAuth": true}}}}
returns 400 and still enables basic auth. Return after reporting the
error so the request is rejected as a whole, matching every other
validation failure in this handler.
Also correct the property name in the message. It read HttpBasicAuth,
which does not match the property the client sent, so a client cannot
map the error back to its payload.
Tested:
PATCH /redfish/v1/AccountService with an HTTPBasicAuth value of
Unadvertised returns 400 PropertyValueNotInList naming HTTPBasicAuth,
and AccountLockoutThreshold sent in the same body is unchanged. Values
of Enabled and Disabled behave as before.
Change-Id: Ied598d831dac8ec150d6e10028475f5a270ffaff
Signed-off-by: Akshay Gaitonde <a.g@utexas.edu> A
Akshay Gaitonde committed
df3d7b2e079a2b317963c917aec57c6db9d7ef59
Parent: a74ef92