{"record":{"id":"1da6355fee1aff2a","repo":"apolloconfig/apollo","slug":"can-not-operate-other-person-s-favorite","errorCode":null,"errorMessage":"can not operate other person's favorite","messagePattern":"can not operate other person's favorite","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/FavoriteService.java","lineNumber":132,"sourceCode":"    checkUserOperatePermission(favorite, loginUserId);\n\n    String userId = favorite.getUserId();\n    Favorite firstFavorite =\n        favoriteRepository.findFirstByUserIdOrderByPositionAscDataChangeCreatedTimeAsc(userId);\n    long minPosition = firstFavorite.getPosition();\n\n    favorite.setPosition(minPosition - 1);\n\n    favoriteRepository.save(favorite);\n  }\n\n  private void checkUserOperatePermission(Favorite favorite, String loginUserId) {\n    if (favorite == null) {\n      throw new BadRequestException(\"favorite not exist\");\n    }\n\n    if (!Objects.equals(loginUserId, favorite.getUserId())) {\n      throw new BadRequestException(\"can not operate other person's favorite\");\n    }\n  }\n\n  public void batchDeleteByAppId(String appId, String operator) {\n    favoriteRepository.batchDeleteByAppId(appId, operator);\n  }\n}\n","sourceCodeStart":114,"sourceCodeEnd":140,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/FavoriteService.java#L114-L140","documentation":"Thrown as a BadRequestException by FavoriteService.checkUserOperatePermission() when the favorite exists but its userId does not match the loginUserId. This is an ownership check: only the user who created a favorite can modify or delete it. The check is separate from the null check (error 193) and fires only for favorites that exist but belong to someone else.","triggerScenarios":"Calling an operation (delete, adjust position) on a favorite whose userId differs from the authenticated loginUserId. For example, userA tries to delete userB's favorite by guessing or enumerating the favorite ID.","commonSituations":"Client-side bug passing the wrong favorite ID; attempt to operate on another user's favorite; session mismatch where loginUserId is incorrect; shared bookmark/favorite ID across users in a multi-tenant confusion.","solutions":["Ensure the client only operates on favorites belonging to the current user by filtering the favorites list by userId.","Verify the loginUserId in the session matches the favorite's owner before performing operations.","If admin operations on other users' favorites are needed, implement a separate admin-authorized endpoint.","Refresh the favorites list to confirm ownership before attempting modify/delete."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify ownership before operating on a favorite\nFavorite favorite = favoriteRepository.findById(favoriteId).orElse(null);\nif (favorite == null) {\n  throw new IllegalArgumentException(\"Favorite not found\");\n}\nif (!Objects.equals(favorite.getUserId(), loginUserId)) {\n  throw new SecurityException(\"Not authorized to operate on this favorite\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only pass favorite IDs that belong to the current user.","Filter the favorites list by userId before allowing operations.","Use admin-specific endpoints for cross-user favorite management."],"tags":["apollo-portal","favorite","authorization","bad-request","ownership"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}