Set count as live to false for broadcast services

We think it would be a security risk to show the name of services
involved in emergency alerts as they be responsible for things such as
counter terrorism.

On top of that, showing broadcast services in the list of all services
could enable someone to use that information to try and trick an admin
into letting them access of a particular service given the fact they
know the name of it
This commit is contained in:
David McDonald
2021-02-04 18:06:08 +00:00
parent 54b9d20f73
commit cdcbd1e238
3 changed files with 25 additions and 2 deletions

View File

@@ -1092,10 +1092,11 @@ def create_contact_list(service_id):
@service_blueprint.route('/<uuid:service_id>/set-as-broadcast-service', methods=['POST'])
def set_as_broadcast_service(service_id):
"""
This route does three things
This route does four things
- adds a service broadcast settings to define which channel broadcasts should go out on
- removes all current service permissions
- adds the broadcast service permission
- sets the services `count_as_live` to false
"""
data = validate(request.get_json(), service_broadcast_settings_schema)
service = dao_fetch_service_by_id(service_id)
@@ -1107,5 +1108,8 @@ def set_as_broadcast_service(service_id):
dao_remove_service_permission(service.id, permission.permission)
dao_add_service_permission(service.id, BROADCAST_TYPE)
service.count_as_live = False
dao_update_service(service)
data = service_schema.dump(service).data
return jsonify(data=data)