Closed Bug 871761 Opened 11 years ago Closed 11 years ago

API should not return can_rate=true for anon users for paid apps

Categories

(Marketplace Graveyard :: API, defect, P2)

Product:
Marketplace Graveyard
Component:
API
Platform:
x86
macOS
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: basta, Assigned: chuck)

References

Details

(Whiteboard: [fireplace] p=1) 

Presently, when accessing the ratings API, anonymous users will see "can_rate":true, which is false. Only signed in users who have purchased a paid app should be able to submit a review.
Blocks: 859511
Whiteboard: [fireplace]
Blocks: 871484
Assignee: nobody → charmston
Priority: -- → P2
Whiteboard: [fireplace] → [fireplace] p=1
STR? I can't reproduce.

'can_rate' appears as a member of the `user` object in API responses, which should be `None` in anonymous requests.
Flags: needinfo?(mattbasta)
Looks like this has changed in the past week or so; the user object is null for me now. Very odd. Will reopen if I find shenanigans.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(mattbasta)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.