funkythings
/
api
forked from vikunja/vikunja
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

feat(webhooks): prevent link shares from managing webhooks

This commit is contained in:
kolaente 2023-09-14 12:15:37 +02:00
parent 57de44694c
commit eb1b9247ad
Signed by untrusted user: konrad
GPG Key ID: F40E70337AB24C9B
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
pkg/models/webhooks_rights.go
View File

@ -27,16 +27,23 @@ func (w *Webhook) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
}
func (w *Webhook) CanDelete(s *xorm.Session, a web.Auth) (bool, error) {
p := &Project{ID: w.ProjectID}
return p.CanUpdate(s, a)
return w.canDoWebhook(s, a)
}
func (w *Webhook) CanUpdate(s *xorm.Session, a web.Auth) (bool, error) {
p := &Project{ID: w.ProjectID}
return p.CanUpdate(s, a)
return w.canDoWebhook(s, a)
}
func (w *Webhook) CanCreate(s *xorm.Session, a web.Auth) (bool, error) {
return w.canDoWebhook(s, a)
}
func (w *Webhook) canDoWebhook(s *xorm.Session, a web.Auth) (bool, error) {
_, isShareAuth := a.(*LinkSharing)
if isShareAuth {
return false, nil
}
p := &Project{ID: w.ProjectID}
return p.CanUpdate(s, a)
}