nickslowinski/vaultwarden-test
1
0
Fork 0
geforkt von mirrored/vaultwarden
Code Pull-Requests Aktivität

Merge pull request #1333 from jjlin/fix-manager-access

Quellcode durchsuchen 
Fix collection access issues for owner/admin users
Dieser Commit ist enthalten in:
Mathijs van Veluw 2021-01-27 08:07:20 +01:00 committet von GitHub
Commit b884fd20a1
Es konnte kein GPG-Schlüssel zu dieser Signatur gefunden werden
GPG-Schlüssel-ID: 4AEE18F83AFDEB23
1 geänderte Dateien mit 7 neuen und 7 gelöschten Zeilen
Statistiken anzeigen Patch-Datei herunterladen Diff-Datei herunterladen Alle Dateien ausklappen Alle Dateien einklappen

14
src/auth.rs
Datei anzeigen

@ -330,9 +330,9 @@ pub struct OrgHeaders {
pub org_id: String, pub org_id: String,
} }
// org_id is usually the second param ("/organizations/<org_id>") // org_id is usually the second path param ("/organizations/<org_id>"),
// But there are cases where it is located in a query value. // but there are cases where it is a query value.
// First check the param, if this is not a valid uuid, we will try the query value. // First check the path, if this is not a valid uuid, try the query values.
fn get_org_id(request: &Request) -> Option<String> { fn get_org_id(request: &Request) -> Option<String> {
if let Some(Ok(org_id)) = request.get_param::<String>(1) { if let Some(Ok(org_id)) = request.get_param::<String>(1) {
if uuid::Uuid::parse_str(&org_id).is_ok() { if uuid::Uuid::parse_str(&org_id).is_ok() {
@ -439,9 +439,9 @@ impl Into<Headers> for AdminHeaders {
} }
} }
// col_id is usually the forth param ("/organizations/<org_id>/collections/<col_id>") // col_id is usually the fourth path param ("/organizations/<org_id>/collections/<col_id>"),
// But there cloud be cases where it is located in a query value. // but there could be cases where it is a query value.
// First check the param, if this is not a valid uuid, we will try the query value. // First check the path, if this is not a valid uuid, try the query values.
fn get_col_id(request: &Request) -> Option<String> { fn get_col_id(request: &Request) -> Option<String> {
if let Some(Ok(col_id)) = request.get_param::<String>(3) { if let Some(Ok(col_id)) = request.get_param::<String>(3) {
if uuid::Uuid::parse_str(&col_id).is_ok() { if uuid::Uuid::parse_str(&col_id).is_ok() {
@ -484,7 +484,7 @@ impl<'a, 'r> FromRequest<'a, 'r> for ManagerHeaders {
_ => err_handler!("Error getting DB"), _ => err_handler!("Error getting DB"),
}; };
if !headers.org_user.access_all { if !headers.org_user.has_full_access() {
match CollectionUser::find_by_collection_and_user(&col_id, &headers.org_user.user_uuid, &conn) { match CollectionUser::find_by_collection_and_user(&col_id, &headers.org_user.user_uuid, &conn) {
Some(_) => (), Some(_) => (),
None => err_handler!("The current user isn't a manager for this collection"), None => err_handler!("The current user isn't a manager for this collection"),