server/AyaNova/Controllers/ReportController.cs

@@ -171,6 +171,9 @@ namespace AyaNova.Api.Controllers
             ReportBiz biz = ReportBiz.GetBiz(ct, HttpContext);
             if (!Authorized.HasReadFullRole(HttpContext.Items, biz.BizType))
                 return StatusCode(403, new ApiNotAuthorizedResponse());
+            //extra check if they have rights to the type of object in question, this nips it in the bud before they even get to the fetch data stage later
+            if (!Authorized.HasReadFullRole(HttpContext.Items, ayType))
+                return StatusCode(403, new ApiNotAuthorizedResponse());
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
             var o = await biz.GetReportListAsync(ayType);

server/AyaNova/biz/ReportBiz.cs

@@ -170,8 +170,10 @@ namespace AyaNova.Biz
         {
             var rpts = await ct.Report.AsNoTracking().Where(z => z.ObjectType == ayType && z.Active == true).Select(z => new { id = z.Id, name = z.Name, roles = z.Roles }).ToListAsync();
             var ret = new List<NameIdItem>();
-            foreach(var item in rpts){                
-                if(CurrentUserRoles.HasAnyFlags(item.roles)){
+            foreach (var item in rpts)
+            {
+                if (CurrentUserRoles.HasAnyFlags(item.roles))
+                {
                     ret.Add(new NameIdItem() { Name = item.name, Id = item.id });
                 }
             }