vikunja
/
web
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixed rights check

This commit is contained in:
kolaente 2019-03-29 18:09:35 +01:00
parent 62b466dd13
commit 7dc1f4191c
Signed by: konrad
GPG Key ID: F40E70337AB24C9B
4 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
handler/create.go
View File

@ -42,11 +42,11 @@ func (c *WebHandler) CreateWeb(ctx echo.Context) error {
}
// Check rights
canRead, err := currentStruct.CanCreate(currentAuth)
canCreate, err := currentStruct.CanCreate(currentAuth)
if err != nil {
return HandleHTTPError(err, ctx)
}
if canRead {
if !canCreate {
config.LoggingProvider.Noticef("Tried to create while not having the rights for it (User: %v)", currentAuth)
return echo.NewHTTPError(http.StatusForbidden)
}

4
handler/delete.go
View File

@ -44,8 +44,8 @@ func (c *WebHandler) DeleteWeb(ctx echo.Context) error {
if err != nil {
return HandleHTTPError(err, ctx)
}
if canDelete {
config.LoggingProvider.Noticef("Tried to create while not having the rights for it (User: %v)", currentAuth)
if !canDelete {
config.LoggingProvider.Noticef("Tried to delete while not having the rights for it (User: %v)", currentAuth)
return echo.NewHTTPError(http.StatusForbidden)
}

4
handler/read_one.go
View File

@ -39,8 +39,8 @@ func (c *WebHandler) ReadOneWeb(ctx echo.Context) error {
if err != nil {
return HandleHTTPError(err, ctx)
}
if canRead {
config.LoggingProvider.Noticef("Tried to create while not having the rights for it (User: %v)", currentAuth)
if !canRead {
config.LoggingProvider.Noticef("Tried to read while not having the rights for it (User: %v)", currentAuth)
return echo.NewHTTPError(http.StatusForbidden, "You don't have the right to see this")
}

4
handler/update.go
View File

@ -45,8 +45,8 @@ func (c *WebHandler) UpdateWeb(ctx echo.Context) error {
if err != nil {
return HandleHTTPError(err, ctx)
}
if canUpdate {
config.LoggingProvider.Noticef("Tried to create while not having the rights for it (User: %v)", currentAuth)
if !canUpdate {
config.LoggingProvider.Noticef("Tried to update while not having the rights for it (User: %v)", currentAuth)
return echo.NewHTTPError(http.StatusForbidden)
}