cyberpresidentvanellope/tgstation-server
1
0
Fork 0
mirror of https://github.com/tgstation/tgstation-server.git synced 2026-08-28 15:40:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #726 from tgstation/724-LEARN_TO_READ

Browse Source 
Disallow reading from update methods unless user has read right
This commit is contained in:
Jordan Brown
2018-09-26 16:54:42 -04:00
committed by GitHub
parent e699592e56 e68a8e3c43
commit 5d0c165f92
5 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Tgstation.Server.Host/Controllers/ByondController.cs
+2 -1
View File
@@ -98,7 +98,8 @@ namespace Tgstation.Server.Host.Controllers
await jobManager.RegisterOperation(job, (paramJob, databaseContext, progressHandler, ct) => byondManager.ChangeVersion(installingVersion, ct), cancellationToken).ConfigureAwait(false);
result.InstallJob = job.ToApi();
}
result.Version = byondManager.ActiveVersion;
if ((AuthenticationContext.GetRight(RightsType.Byond) & (ulong)ByondRights.ReadActive) != 0)
result.Version = byondManager.ActiveVersion;
return result.InstallJob != null ? (IActionResult)Accepted(result) : Json(result);
}
}
src/Tgstation.Server.Host/Controllers/DreamMakerController.cs
+4
View File
@@ -135,6 +135,10 @@ namespace Tgstation.Server.Host.Controllers
}
await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
if ((AuthenticationContext.GetRight(RightsType.DreamMaker) & (ulong)DreamMakerRights.Read) == 0)
return Ok();
return await Read(cancellationToken).ConfigureAwait(false);
}
}
src/Tgstation.Server.Host/Controllers/InstanceController.cs
+4 -1
View File
@@ -341,7 +341,10 @@ namespace Tgstation.Server.Host.Controllers
throw;
}
var api = originalModel.ToApi();
var api = (AuthenticationContext.GetRight(RightsType.InstanceManager) & (ulong)InstanceManagerRights.Read) != 0 ? originalModel.ToApi() : new Api.Models.Instance
{
Id = originalModel.Id
};
if (originalModelPath != null)
{
var job = new Models.Job
src/Tgstation.Server.Host/Controllers/InstanceUserController.cs
+4 -1
View File
@@ -92,7 +92,10 @@ namespace Tgstation.Server.Host.Controllers
originalUser.DreamMakerRights = model.DreamMakerRights ?? originalUser.DreamMakerRights;
await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
return Json(originalUser.ToApi());
return Json(originalUser.UserId == AuthenticationContext.User.Id || (AuthenticationContext.GetRight(RightsType.InstanceUser) & (ulong)InstanceUserRights.ReadUsers) != 0 ? originalUser.ToApi() : new Api.Models.InstanceUser
{
UserId = originalUser.UserId
});
}
/// <inheritdoc />
src/Tgstation.Server.Host/Controllers/UserController.cs
+4 -1
View File
@@ -156,7 +156,10 @@ namespace Tgstation.Server.Host.Controllers
await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
return Json(originalUser.ToApi(true));
return Json(model.Id == originalUser.Id || (AuthenticationContext.GetRight(RightsType.Administration) & (ulong)AdministrationRights.ReadUsers) != 0 ? originalUser.ToApi(true) : new Api.Models.User
{
Id = originalUser.Id
});
}
/// <inheritdoc />