admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Browse Source
This commit is contained in:
John Cardinal
2019-05-16 22:57:26 +00:00
parent 8fe776a3ac
commit 73c4fdd93e
7 changed files with 19 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
server/AyaNova/ControllerHelpers/Authorized.cs
View File

@@ -6,6 +6,8 @@ using AyaNova.Biz;
namespace AyaNova.Api.ControllerHelpers namespace AyaNova.Api.ControllerHelpers
{ {
//AUTHORIZATION ROLES: NOTE - this is only 'stage1' of generally checking rights, individual objects can also have business rules that affect access exactly as these roles do
//Most objects won't need more than this but some specialized ones will have further checks depending on biz rules
internal static class Authorized internal static class Authorized
{ {
@@ -104,13 +106,13 @@ namespace AyaNova.Api.ControllerHelpers
/// </summary> /// </summary>
/// <param name="HttpContextItems"></param> /// <param name="HttpContextItems"></param>
/// <param name="objectType"></param> /// <param name="objectType"></param>
/// <returns></returns> /// <returns></returns>
internal static bool HasModifyRole(IDictionary<object, object> HttpContextItems, AyaType objectType) internal static bool HasModifyRole(IDictionary<object, object> HttpContextItems, AyaType objectType)
{ {
AuthorizationRoles currentUserRoles = UserRolesFromContext.Roles(HttpContextItems); AuthorizationRoles currentUserRoles = UserRolesFromContext.Roles(HttpContextItems);
return HasModifyRole(currentUserRoles, objectType); return HasModifyRole(currentUserRoles, objectType);
} }
@@ -157,7 +159,7 @@ namespace AyaNova.Api.ControllerHelpers
if (currentUserRoles.HasAnyFlags(BizRoles.GetRoleSet(objectType).Change)) if (currentUserRoles.HasAnyFlags(BizRoles.GetRoleSet(objectType).Change))
return true; return true;
return false; return false;
} }

4
server/AyaNova/Controllers/AttachmentController.cs
View File

@@ -195,7 +195,7 @@ namespace AyaNova.Api.Controllers
// else // else
// { // {
// User needs modify rights to the object type in question // User needs modify rights to the object type in question
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, attachToObject.ObjectType, attachToObjectOwnerId)) if (!Authorized.HasModifyRole(HttpContext.Items, attachToObject.ObjectType))
{ {
//delete temp files //delete temp files
DeleteTempFileUploadDueToBadRequest(uploadFormData); DeleteTempFileUploadDueToBadRequest(uploadFormData);
@@ -293,7 +293,7 @@ namespace AyaNova.Api.Controllers
long UserId = UserIdFromContext.Id(HttpContext.Items); long UserId = UserIdFromContext.Id(HttpContext.Items);
if (!Authorized.IsAuthorizedToDelete(HttpContext.Items, dbObj.AttachToObjectType, dbObj.OwnerId)) if (!Authorized.HasDeleteRole(HttpContext.Items, dbObj.AttachToObjectType))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }

4
server/AyaNova/Controllers/DataFilterController.cs
View File

@@ -127,7 +127,7 @@ namespace AyaNova.Api.Controllers
if (o == null) if (o == null)
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, biz.BizType, o.OwnerId)) if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType))
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
try try
@@ -206,7 +206,7 @@ namespace AyaNova.Api.Controllers
if (o == null) if (o == null)
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
if (!Authorized.IsAuthorizedToDelete(HttpContext.Items, biz.BizType, o.OwnerId)) if (!Authorized.HasDeleteRole(HttpContext.Items, biz.BizType))
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
if (!biz.Delete(o)) if (!biz.Delete(o))

2
server/AyaNova/Controllers/FormCustomController.cs
View File

@@ -200,7 +200,7 @@ namespace AyaNova.Api.Controllers
if (o == null) if (o == null)
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, biz.BizType, o.OwnerId)) if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType))
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
try try

6
server/AyaNova/Controllers/LocaleController.cs
View File

@@ -233,7 +233,7 @@ namespace AyaNova.Api.Controllers
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
} }
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, AyaType.Locale, oDbParent.OwnerId)) if (!Authorized.HasModifyRole(HttpContext.Items, AyaType.Locale))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }
@@ -299,7 +299,7 @@ namespace AyaNova.Api.Controllers
} }
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, AyaType.Locale, oFromDb.OwnerId)) if (!Authorized.HasModifyRole(HttpContext.Items, AyaType.Locale))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }
@@ -367,7 +367,7 @@ namespace AyaNova.Api.Controllers
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
} }
if (!Authorized.IsAuthorizedToDelete(HttpContext.Items, AyaType.Locale, dbObj.OwnerId)) if (!Authorized.HasDeleteRole(HttpContext.Items, AyaType.Locale))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }

6
server/AyaNova/Controllers/UserController.cs
View File

@@ -214,7 +214,7 @@ namespace AyaNova.Api.Controllers
//Instantiate the business object handler //Instantiate the business object handler
UserBiz biz = UserBiz.GetBiz(ct, HttpContext); UserBiz biz = UserBiz.GetBiz(ct, HttpContext);
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, biz.BizType, o.OwnerId)) if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }
@@ -278,7 +278,7 @@ namespace AyaNova.Api.Controllers
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
} }
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, biz.BizType, o.OwnerId)) if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }
@@ -392,7 +392,7 @@ namespace AyaNova.Api.Controllers
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
} }
if (!Authorized.IsAuthorizedToDelete(HttpContext.Items, biz.BizType, dbObj.OwnerId)) if (!Authorized.HasDeleteRole(HttpContext.Items, biz.BizType))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }

4
server/AyaNova/Controllers/UserOptionsController.cs
View File

@@ -120,7 +120,7 @@ namespace AyaNova.Api.Controllers
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
} }
if (id != UserId && !Authorized.IsAuthorizedToModify(HttpContext.Items, AyaType.UserOptions, o.OwnerId)) if (id != UserId && !Authorized.HasModifyRole(HttpContext.Items, AyaType.UserOptions, o.OwnerId))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }
@@ -189,7 +189,7 @@ namespace AyaNova.Api.Controllers
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
} }
if (id != UserId && !Authorized.IsAuthorizedToModify(HttpContext.Items, AyaType.UserOptions, o.OwnerId)) if (id != UserId && !Authorized.HasModifyRole(HttpContext.Items, AyaType.UserOptions, o.OwnerId))
{ {
return StatusCode(403, new ApiNotAuthorizedResponse()); return StatusCode(403, new ApiNotAuthorizedResponse());
} }