Mirrors/VILLASweb-backend-go
1
0
Fork 0
mirror of https://git.rwth-aachen.de/acs/public/villas/web-backend-go/ synced 2025-03-30 00:00:12 +01:00
Code Issues Releases Wiki Activity

fix access checking for scenarios

Browse source
This commit is contained in:
Sonja Happ 2021-04-20 17:10:29 +02:00
parent 75aa4a023f
commit 2c79523a50
2 changed files with 24 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
routes/scenario/scenario_methods.go
View file

@ -152,20 +152,32 @@ func (s *Scenario) delete() error {
return nil return nil
} }
func (s *Scenario) checkAccess(userID uint, userRole string, operation database.CRUD) bool { func (s *Scenario) checkAccess(userID uint, operation database.CRUD) bool {
if userRole == "Admin" { db := database.GetDB()
u := database.User{}
err := db.Find(&u, userID).Error
if err != nil {
return false
}
if u.Role == "Admin" {
return true return true
}
scenarioUser := database.User{}
err = db.Order("ID asc").Model(s).Where("ID = ?", userID).Related(&scenarioUser, "Users").Error
if err != nil {
return false
}
if !scenarioUser.Active {
return false
} else if s.IsLocked && operation != database.Read {
return false
} else { } else {
db := database.GetDB() return true
u := database.User{}
u.Username = ""
err := db.Order("ID asc").Model(s).Where("ID = ?", userID).Related(&u, "Users").Error
if err != nil || !u.Active || (s.IsLocked && operation != database.Read) {
return false
} else {
return true
}
} }
} }

3
routes/scenario/scenario_middleware.go
View file

@ -49,14 +49,13 @@ func CheckPermissions(c *gin.Context, operation database.CRUD, scenarioIDsource
} }
userID, _ := c.Get(database.UserIDCtx) userID, _ := c.Get(database.UserIDCtx)
userRole, _ := c.Get(database.UserRoleCtx)
err = so.ByID(uint(scenarioID)) err = so.ByID(uint(scenarioID))
if helper.DBError(c, err) { if helper.DBError(c, err) {
return false, so return false, so
} }
if so.checkAccess(userID.(uint), userRole.(string), operation) == false { if so.checkAccess(userID.(uint), operation) == false {
helper.UnprocessableEntityError(c, "Access denied (user has no access or scenario is locked).") helper.UnprocessableEntityError(c, "Access denied (user has no access or scenario is locked).")
return false, so return false, so
} }