admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4727 - report template export only to users who may use or edit it

Browse Source 
report/export/{id} by download key gives a template only to a user whose
roles include one of the template's roles, or who may edit templates (a
user with no roles got any template). Job owner check accepted (no owner
recorded; random job ids). F22 (4727 step 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 21:30:47 -07:00
parent 973b64a682
commit b0e3933a9f
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
server/AyaNova/Controllers/ReportController.cs
View File

@@ -11,6 +11,7 @@ using Microsoft.EntityFrameworkCore;
using AyaNova.Models;
using AyaNova.Api.ControllerHelpers;
using AyaNova.Biz;
using EnumsNET;
using AyaNova.Util;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
@@ -288,7 +289,8 @@ namespace AyaNova.Api.Controllers
if (!ModelState.IsValid)
return BadRequest(new ApiErrorResponse(ModelState));
if (await UserBiz.ValidateDownloadTokenAndReturnUserAsync(t, ct) == null)
var DownloadUser = await UserBiz.ValidateDownloadTokenAndReturnUserAsync(t, ct);
if (DownloadUser == null)
{
await Task.Delay(ServerBootConfig.FAILED_AUTH_DELAY);//DOS protection
return StatusCode(401, new ApiErrorResponse(ApiErrorCode.AUTHENTICATION_FAILED));
@@ -300,6 +302,10 @@ namespace AyaNova.Api.Controllers
{
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
}
//case 4727 (F22): only a template the user may use (its Roles) or may edit
if (!DownloadUser.Roles.HasAnyFlags(o.Roles) && !Authorized.HasModifyRole(DownloadUser.Roles, AyaType.Report))
return StatusCode(403, new ApiNotAuthorizedResponse());
var asText = Newtonsoft.Json.JsonConvert.SerializeObject(
o,
Newtonsoft.Json.Formatting.None,