Nemcio/GitBucket
1
0
Fork 0
mirror of https://github.com/gitbucket/gitbucket.git synced 2025-11-04 20:45:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

(refs #2184) Fix authorization for group web hook configuration page

Browse Source
This commit is contained in:
Naoki Takezoe
2018-11-13 21:32:31 +09:00
parent e8262cf5ce
commit 41f1c0c136
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/main/scala/gitbucket/core/controller/AccountController.scala
View File

@@ -421,7 +421,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
redirect(s"/${userName}/_application")
})
get("/:userName/_hooks")(oneselfOnly {
get("/:userName/_hooks")(managersOnly {
val userName = params("userName")
getAccountByUserName(userName).map { account =>
gitbucket.core.account.html.hooks(account, getAccountWebHooks(account.userName), flash.get("info"))
@@ -431,7 +431,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/**
* Display the account web hook edit page.
*/
get("/:userName/_hooks/new")(oneselfOnly {
get("/:userName/_hooks/new")(managersOnly {
val userName = params("userName")
getAccountByUserName(userName).map { account =>
val webhook = AccountWebHook(userName, "", WebHookContentType.FORM, None)
@@ -442,7 +442,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/**
* Add the account web hook URL.
*/
post("/:userName/_hooks/new", accountWebHookForm(false))(oneselfOnly { form =>
post("/:userName/_hooks/new", accountWebHookForm(false))(managersOnly { form =>
val userName = params("userName")
addAccountWebHook(userName, form.url, form.events, form.ctype, form.token)
flash += "info" -> s"Webhook ${form.url} created"
@@ -452,7 +452,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/**
* Delete the account web hook URL.
*/
get("/:userName/_hooks/delete")(oneselfOnly {
get("/:userName/_hooks/delete")(managersOnly {
val userName = params("userName")
deleteAccountWebHook(userName, params("url"))
flash += "info" -> s"Webhook ${params("url")} deleted"
@@ -462,7 +462,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/**
* Display the account web hook edit page.
*/
get("/:userName/_hooks/edit")(oneselfOnly {
get("/:userName/_hooks/edit")(managersOnly {
val userName = params("userName")
getAccountByUserName(userName).flatMap { account =>
getAccountWebHook(userName, params("url")).map {
@@ -475,7 +475,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/**
* Update account web hook settings.
*/
post("/:userName/_hooks/edit", accountWebHookForm(true))(oneselfOnly { form =>
post("/:userName/_hooks/edit", accountWebHookForm(true))(managersOnly { form =>
val userName = params("userName")
updateAccountWebHook(userName, form.url, form.events, form.ctype, form.token)
flash += "info" -> s"webhook ${form.url} updated"
@@ -485,7 +485,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/**
* Send the test request to registered account web hook URLs.
*/
ajaxPost("/:userName/_hooks/test")(oneselfOnly {
ajaxPost("/:userName/_hooks/test")(managersOnly {
// TODO Is it possible to merge with [[RepositorySettingsController.ajaxPost]]?
import scala.concurrent.duration._
import scala.concurrent._

2
src/main/scala/gitbucket/core/util/Authenticator.scala
View File

@@ -161,6 +161,8 @@ trait GroupManagerAuthenticator { self: ControllerBase with AccountService =>
private def authenticate(action: => Any) = {
context.loginAccount match {
case Some(x) if x.isAdmin => action
case Some(x) if x.userName == request.paths(0) => action
case Some(x) if (getGroupMembers(request.paths(0)).exists { member =>
member.userName == x.userName && member.isManager
}) =>