From 7643e91f841e5ccd9d0f2b177ec5b2faf5d50878 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sat, 21 Oct 2023 05:23:28 -0400 Subject: [PATCH] Fix `EngineController.Update` permissions --- .../Controllers/EngineController.cs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/Tgstation.Server.Host/Controllers/EngineController.cs b/src/Tgstation.Server.Host/Controllers/EngineController.cs index 83f6991991..47c9044f73 100644 --- a/src/Tgstation.Server.Host/Controllers/EngineController.cs +++ b/src/Tgstation.Server.Host/Controllers/EngineController.cs @@ -151,8 +151,15 @@ namespace Tgstation.Server.Host.Controllers var uploadingZip = model.UploadCustomZip == true; var userByondRights = AuthenticationContext.InstancePermissionSet.EngineRights.Value; - if ((!userByondRights.HasFlag(EngineRights.InstallOfficialOrChangeActiveByondVersion) && !uploadingZip) - || (!userByondRights.HasFlag(EngineRights.InstallCustomByondVersion) && uploadingZip)) + var isByondEngine = model.EngineVersion.Engine.Value == EngineType.Byond; + var officialPerm = isByondEngine + ? EngineRights.InstallOfficialOrChangeActiveByondVersion + : EngineRights.InstallOfficialOrChangeActiveOpenDreamVersion; + var customPerm = isByondEngine + ? EngineRights.InstallCustomByondVersion + : EngineRights.InstallCustomOpenDreamVersion; + if ((!userByondRights.HasFlag(officialPerm) && !uploadingZip) + || (!userByondRights.HasFlag(customPerm) && uploadingZip)) return Forbid(); // remove cruff fields