admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4727 - attached-by override for admins only, export download by its owner only

Browse Source 
OverrideUserId on attachment upload is used only from SuperUser or a user
with change rights on User, otherwise ignored. Export files carry the
user's id in their name and export/download serves only the key user's
own export files. F25 (4727 step 5).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 21:39:50 -07:00
parent b0e3933a9f
commit cce07f3e6b
4 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
server/AyaNova/Controllers/AttachmentController.cs
View File

@@ -269,7 +269,9 @@ namespace AyaNova.Api.Controllers
{
AttachToAType = uploadFormData.FormFieldData["AttachToAType"].ToString();
//for v8 migrate purposes
if (uploadFormData.FormFieldData.ContainsKey("OverrideUserId"))
//case 4727 (F25): only SuperUser or a user who may manage users may set it, otherwise it is ignored
if (uploadFormData.FormFieldData.ContainsKey("OverrideUserId") &&
(UserIdFromContext.Id(HttpContext.Items) == 1 || Authorized.HasModifyRole(HttpContext.Items, AyaType.User)))
OverrideUserId = long.Parse(uploadFormData.FormFieldData["OverrideUserId"].ToString());
AttachToObjectId = uploadFormData.FormFieldData["AttachToObjectId"].ToString();