shpaq/sct-overseerr
1
0
Fork 0
mirror of https://github.com/sct/overseerr.git synced 2025-09-17 17:24:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: add missing route guards to issues pages (#2235)

Browse Source 
* fix: users should always be able to view their own issues

* fix: apply route guards to issues pages instead

* fix(api): only allow users w/ issue perms to edit comments / delete issues
This commit is contained in:
TheCatLady
2021-10-31 11:56:59 -04:00
committed by GitHub
parent 3ec4a9c76e
commit c79dc9f70f
4 changed files with 75 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
server/routes/issue.ts
View File

@@ -68,7 +68,7 @@ issueRoutes.get<Record<string, string>, IssueResultsResponse>(
return next({
status: 403,
message:
'You do not have permission to view issues created by other users',
'You do not have permission to view issues reported by other users',
});
}
query = query.andWhere('createdBy.id = :id', { id: req.user?.id });
@@ -291,35 +291,41 @@ issueRoutes.post<{ issueId: string; status: string }, Issue>(
}
);
issueRoutes.delete('/:issueId', async (req, res, next) => {
const issueRepository = getRepository(Issue);
issueRoutes.delete(
'/:issueId',
isAuthenticated([Permission.MANAGE_ISSUES, Permission.CREATE_ISSUES], {
type: 'or',
}),
async (req, res, next) => {
const issueRepository = getRepository(Issue);
try {
const issue = await issueRepository.findOneOrFail({
where: { id: Number(req.params.issueId) },
relations: ['createdBy'],
});
if (
!req.user?.hasPermission(Permission.MANAGE_ISSUES) &&
(issue.createdBy.id !== req.user?.id || issue.comments.length > 1)
) {
return next({
status: 401,
message: 'You do not have permission to delete this issue.',
try {
const issue = await issueRepository.findOneOrFail({
where: { id: Number(req.params.issueId) },
relations: ['createdBy'],
});
if (
!req.user?.hasPermission(Permission.MANAGE_ISSUES) &&
(issue.createdBy.id !== req.user?.id || issue.comments.length > 1)
) {
return next({
status: 401,
message: 'You do not have permission to delete this issue.',
});
}
await issueRepository.remove(issue);
return res.status(204).send();
} catch (e) {
logger.error('Something went wrong deleting an issue.', {
label: 'API',
errorMessage: e.message,
});
next({ status: 404, message: 'Issue not found.' });
}
await issueRepository.remove(issue);
return res.status(204).send();
} catch (e) {
logger.error('Something went wrong deleting an issue.', {
label: 'API',
errorMessage: e.message,
});
next({ status: 404, message: 'Issue not found.' });
}
});
);
export default issueRoutes;

19
server/routes/request.ts
View File

@@ -500,9 +500,26 @@ requestRoutes.get('/:requestId', async (req, res, next) => {
relations: ['requestedBy', 'modifiedBy'],
});
if (
request.requestedBy.id !== req.user?.id &&
!req.user?.hasPermission(
[Permission.MANAGE_REQUESTS, Permission.REQUEST_VIEW],
{ type: 'or' }
)
) {
return next({
status: 403,
message: 'You do not have permission to view this request.',
});
}
return res.status(200).json(request);
} catch (e) {
next({ status: 404, message: 'Request not found' });
logger.debug('Failed to retrieve request.', {
label: 'API',
errorMessage: e.message,
});
next({ status: 404, message: 'Request not found.' });
}
});