Mirrors/VILLASweb-backend-go
1
0
Fork 0
mirror of https://git.rwth-aachen.de/acs/public/villas/web-backend-go/ synced 2025-03-30 00:00:12 +01:00
Code Issues Releases Wiki Activity

add user role Download; limit access check to scenario in file middleware #52

Browse source
This commit is contained in:
Sonja Happ 2021-04-14 11:11:28 +02:00
parent 2f6f942749
commit f3d6353f86
2 changed files with 19 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
database/roles.go
View file

@ -112,6 +112,19 @@ var Roles = RoleActions{
ModelFile: _r__,
ModelResult: none,
},
"Download": {
ModelScenario: none,
ModelComponentConfiguration: none,
ModelDashboard: none,
ModelWidget: none,
ModelInfrastructureComponent: none,
ModelInfrastructureComponentAction: none,
ModelUser: none,
ModelUsers: none,
ModelSignal: none,
ModelFile: _r__,
ModelResult: none,
},
}
func ValidateRole(c *gin.Context, model ModelName, action CRUD) error {

9
routes/file/file_middleware.go
View file

@ -49,9 +49,12 @@ func CheckPermissions(c *gin.Context, operation database.CRUD) (bool, File) {
return false, f
}
ok, _ := scenario.CheckPermissions(c, operation, "body", int(f.ScenarioID))
if !ok {
return false, f
if operation != database.Read {
// check access to scenario only if operation is not Read (=download) of file
ok, _ := scenario.CheckPermissions(c, operation, "body", int(f.ScenarioID))
if !ok {
return false, f
}
}
return true, f