admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4718 - report and translation import need create rights

Browse Source 
report/upload and translation/upload had no role check, so any login, customer
contacts included, could import a report template (whose JavaScript runs in the
server's browser at render time) or a translation (security review F19, F24).
Both now require the same right as creating one, checked before the upload is
read. The import screens are already limited to those roles.

Checked locally: customer contact and Service 403, BizAdmin 202.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 12:10:00 -07:00
parent a843bd3132
commit 705a54f9d8
4 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
server/AyaNova/Controllers/ReportController.cs
View File

@@ -329,6 +329,9 @@ namespace AyaNova.Api.Controllers
if (!serverState.IsOpen)
return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
//case 4718: importing a template creates one, so it needs the same right as creating one (checked before the upload is read)
if (!Authorized.HasCreateRole(HttpContext.Items, AyaType.Report))
return StatusCode(403, new ApiNotAuthorizedResponse());
// AyaTypeId attachToObject = null;
ApiUploadProcessor.ApiUploadedFilesResult uploadFormData = null;

3
server/AyaNova/Controllers/TranslationController.cs
View File

@@ -326,6 +326,9 @@ namespace AyaNova.Api.Controllers
if (!serverState.IsOpen)
return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
//case 4718: importing a translation creates one, so it needs the same right as creating one (checked before the upload is read)
if (!Authorized.HasCreateRole(HttpContext.Items, AyaType.Translation))
return StatusCode(403, new ApiNotAuthorizedResponse());
// AyaTypeId attachToObject = null;
ApiUploadProcessor.ApiUploadedFilesResult uploadFormData = null;