From e68a8e3c43674e1d60fb5891cdb4587e935721b2 Mon Sep 17 00:00:00 2001
From: Cyberboss <Cyberboss@users.noreply.github.com>
Date: Wed, 26 Sep 2018 16:03:05 -0400
Subject: [PATCH] Disallow reading from update methods unless user has read
 right

---
 src/Tgstation.Server.Host/Controllers/ByondController.cs     | 3 ++-
 .../Controllers/DreamMakerController.cs                      | 4 ++++
 src/Tgstation.Server.Host/Controllers/InstanceController.cs  | 5 ++++-
 .../Controllers/InstanceUserController.cs                    | 5 ++++-
 src/Tgstation.Server.Host/Controllers/UserController.cs      | 5 ++++-
 5 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/src/Tgstation.Server.Host/Controllers/ByondController.cs b/src/Tgstation.Server.Host/Controllers/ByondController.cs
index f8be5a0174..49e4c38be7 100644
--- a/src/Tgstation.Server.Host/Controllers/ByondController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ByondController.cs
@@ -98,7 +98,8 @@ namespace Tgstation.Server.Host.Controllers
 				await jobManager.RegisterOperation(job, (paramJob, databaseContext, progressHandler, ct) => byondManager.ChangeVersion(installingVersion, ct), cancellationToken).ConfigureAwait(false);
 				result.InstallJob = job.ToApi();
 			}
-			result.Version = byondManager.ActiveVersion;
+			if ((AuthenticationContext.GetRight(RightsType.Byond) & (ulong)ByondRights.ReadActive) != 0)
+				result.Version = byondManager.ActiveVersion;
 			return result.InstallJob != null ? (IActionResult)Accepted(result) : Json(result);
 		}
 	}
diff --git a/src/Tgstation.Server.Host/Controllers/DreamMakerController.cs b/src/Tgstation.Server.Host/Controllers/DreamMakerController.cs
index 8551b58622..b84d4b9f15 100644
--- a/src/Tgstation.Server.Host/Controllers/DreamMakerController.cs
+++ b/src/Tgstation.Server.Host/Controllers/DreamMakerController.cs
@@ -135,6 +135,10 @@ namespace Tgstation.Server.Host.Controllers
 			}
 
 			await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
+
+			if ((AuthenticationContext.GetRight(RightsType.DreamMaker) & (ulong)DreamMakerRights.Read) == 0)
+				return Ok();
+
 			return await Read(cancellationToken).ConfigureAwait(false);
 		}
 	}
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceController.cs b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
index 28cc4d34e7..13d5adc19c 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
@@ -341,7 +341,10 @@ namespace Tgstation.Server.Host.Controllers
 				throw;
 			}
 
-			var api = originalModel.ToApi();
+			var api = (AuthenticationContext.GetRight(RightsType.InstanceManager) & (ulong)InstanceManagerRights.Read) != 0 ? originalModel.ToApi() : new Api.Models.Instance
+			{
+				Id = originalModel.Id
+			};
 			if (originalModelPath != null)
 			{
 				var job = new Models.Job
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs b/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs
index aa9a8c8bf7..6c41475aee 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceUserController.cs
@@ -92,7 +92,10 @@ namespace Tgstation.Server.Host.Controllers
 			originalUser.DreamMakerRights = model.DreamMakerRights ?? originalUser.DreamMakerRights;
 
 			await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
-			return Json(originalUser.ToApi());
+			return Json(originalUser.UserId == AuthenticationContext.User.Id || (AuthenticationContext.GetRight(RightsType.InstanceUser) & (ulong)InstanceUserRights.ReadUsers) != 0 ? originalUser.ToApi() : new Api.Models.InstanceUser
+			{
+				UserId = originalUser.UserId
+			});
 		}
 
 		/// <inheritdoc />
diff --git a/src/Tgstation.Server.Host/Controllers/UserController.cs b/src/Tgstation.Server.Host/Controllers/UserController.cs
index 241b08a02f..94705fe465 100644
--- a/src/Tgstation.Server.Host/Controllers/UserController.cs
+++ b/src/Tgstation.Server.Host/Controllers/UserController.cs
@@ -156,7 +156,10 @@ namespace Tgstation.Server.Host.Controllers
 
 			await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
 
-			return Json(originalUser.ToApi(true));
+			return Json(model.Id == originalUser.Id || (AuthenticationContext.GetRight(RightsType.Administration) & (ulong)AdministrationRights.ReadUsers) != 0 ? originalUser.ToApi(true) : new Api.Models.User
+			{
+				Id = originalUser.Id
+			});
 		}
 
 		/// <inheritdoc />