Nemcio/GitBucket
1
0
Fork 0
mirror of https://github.com/gitbucket/gitbucket.git synced 2025-11-06 13:35:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

(refs #2184) Fix authorization for group web hook configuration page

Browse Source
This commit is contained in:
Naoki Takezoe
2018-11-13 21:32:31 +09:00
parent e8262cf5ce
commit 41f1c0c136
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/main/scala/gitbucket/core/controller/AccountController.scala
View File

@@ -421,7 +421,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
redirect(s"/${userName}/_application") redirect(s"/${userName}/_application")
}) })
get("/:userName/_hooks")(oneselfOnly { get("/:userName/_hooks")(managersOnly {
val userName = params("userName") val userName = params("userName")
getAccountByUserName(userName).map { account => getAccountByUserName(userName).map { account =>
gitbucket.core.account.html.hooks(account, getAccountWebHooks(account.userName), flash.get("info")) gitbucket.core.account.html.hooks(account, getAccountWebHooks(account.userName), flash.get("info"))
@@ -431,7 +431,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/** /**
* Display the account web hook edit page. * Display the account web hook edit page.
*/ */
get("/:userName/_hooks/new")(oneselfOnly { get("/:userName/_hooks/new")(managersOnly {
val userName = params("userName") val userName = params("userName")
getAccountByUserName(userName).map { account => getAccountByUserName(userName).map { account =>
val webhook = AccountWebHook(userName, "", WebHookContentType.FORM, None) val webhook = AccountWebHook(userName, "", WebHookContentType.FORM, None)
@@ -442,7 +442,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/** /**
* Add the account web hook URL. * Add the account web hook URL.
*/ */
post("/:userName/_hooks/new", accountWebHookForm(false))(oneselfOnly { form => post("/:userName/_hooks/new", accountWebHookForm(false))(managersOnly { form =>
val userName = params("userName") val userName = params("userName")
addAccountWebHook(userName, form.url, form.events, form.ctype, form.token) addAccountWebHook(userName, form.url, form.events, form.ctype, form.token)
flash += "info" -> s"Webhook ${form.url} created" flash += "info" -> s"Webhook ${form.url} created"
@@ -452,7 +452,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/** /**
* Delete the account web hook URL. * Delete the account web hook URL.
*/ */
get("/:userName/_hooks/delete")(oneselfOnly { get("/:userName/_hooks/delete")(managersOnly {
val userName = params("userName") val userName = params("userName")
deleteAccountWebHook(userName, params("url")) deleteAccountWebHook(userName, params("url"))
flash += "info" -> s"Webhook ${params("url")} deleted" flash += "info" -> s"Webhook ${params("url")} deleted"
@@ -462,7 +462,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/** /**
* Display the account web hook edit page. * Display the account web hook edit page.
*/ */
get("/:userName/_hooks/edit")(oneselfOnly { get("/:userName/_hooks/edit")(managersOnly {
val userName = params("userName") val userName = params("userName")
getAccountByUserName(userName).flatMap { account => getAccountByUserName(userName).flatMap { account =>
getAccountWebHook(userName, params("url")).map { getAccountWebHook(userName, params("url")).map {
@@ -475,7 +475,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/** /**
* Update account web hook settings. * Update account web hook settings.
*/ */
post("/:userName/_hooks/edit", accountWebHookForm(true))(oneselfOnly { form => post("/:userName/_hooks/edit", accountWebHookForm(true))(managersOnly { form =>
val userName = params("userName") val userName = params("userName")
updateAccountWebHook(userName, form.url, form.events, form.ctype, form.token) updateAccountWebHook(userName, form.url, form.events, form.ctype, form.token)
flash += "info" -> s"webhook ${form.url} updated" flash += "info" -> s"webhook ${form.url} updated"
@@ -485,7 +485,7 @@ trait AccountControllerBase extends AccountManagementControllerBase {
/** /**
* Send the test request to registered account web hook URLs. * Send the test request to registered account web hook URLs.
*/ */
ajaxPost("/:userName/_hooks/test")(oneselfOnly { ajaxPost("/:userName/_hooks/test")(managersOnly {
// TODO Is it possible to merge with [[RepositorySettingsController.ajaxPost]]? // TODO Is it possible to merge with [[RepositorySettingsController.ajaxPost]]?
import scala.concurrent.duration._ import scala.concurrent.duration._
import scala.concurrent._ import scala.concurrent._

2
src/main/scala/gitbucket/core/util/Authenticator.scala
View File

@@ -161,6 +161,8 @@ trait GroupManagerAuthenticator { self: ControllerBase with AccountService =>
private def authenticate(action: => Any) = { private def authenticate(action: => Any) = {
context.loginAccount match { context.loginAccount match {
case Some(x) if x.isAdmin => action
case Some(x) if x.userName == request.paths(0) => action
case Some(x) if (getGroupMembers(request.paths(0)).exists { member => case Some(x) if (getGroupMembers(request.paths(0)).exists { member =>
member.userName == x.userName && member.isManager member.userName == x.userName && member.isManager
}) => }) =>