local-it/vikunja-api
0
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Fixed a bug where a user didn't had access to lists which are not his own, but part of a namespace he owns

Browse source
This commit is contained in:
kolaente 2018-09-12 19:56:07 +02:00
parent 65818d6f9e
commit e85d3c4f36
No known key found for this signature in database
GPG key ID: F40E70337AB24C9B
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
models/list_rights.go
View file

@ -74,7 +74,7 @@ func (l *List) checkListTeamRight(user *User, r TeamRight) bool {
Join("LEFT", []string{"team_members", "tm2"}, "tm2.team_id = tl.team_id"). Join("LEFT", []string{"team_members", "tm2"}, "tm2.team_id = tl.team_id").
Where("((tm.user_id = ? AND tn.right = ?) OR (tm2.user_id = ? AND tl.rights = ?)) AND l.id = ?", Where("((tm.user_id = ? AND tn.right = ?) OR (tm2.user_id = ? AND tl.rights = ?)) AND l.id = ?",
user.ID, r, user.ID, r, l.ID). user.ID, r, user.ID, r, l.ID).
Get(&List{}) Exist(&List{})
if err != nil { if err != nil {
return false return false
} }
@ -88,9 +88,13 @@ func (l *List) checkListUserRight(user *User, r UserRight) bool {
Alias("l"). Alias("l").
Join("LEFT", []string{"users_namespace", "un"}, "un.namespace_id = l.namespace_id"). Join("LEFT", []string{"users_namespace", "un"}, "un.namespace_id = l.namespace_id").
Join("LEFT", []string{"users_list", "ul"}, "ul.list_id = l.id"). Join("LEFT", []string{"users_list", "ul"}, "ul.list_id = l.id").
Where("(ul.user_id = ? AND ul.right = ?) AND l.id = ?", Join("LEFT", []string{"namespaces", "n"}, "n.id = l.namespace_id").
user.ID, r, l.ID). Where("((ul.user_id = ? AND ul.right = ?) " +
Get(&List{}) "OR (un.user_id = ? AND un.right = ?) " +
"OR n.owner_id = ?)" +
"AND l.id = ?",
user.ID, r, user.ID, r, user.ID, l.ID).
Exist(&List{})
if err != nil { if err != nil {
return false return false
} }