simon987/task_tracker
1
0
Fork 0
mirror of https://github.com/simon987/task_tracker.git synced 2025-12-10 21:48:52 +00:00
Code Issues Projects Releases Wiki Activity

Task chain requires EDIT_ROLE on both projects

Browse Source
This commit is contained in:
simon987
2019-02-24 19:03:34 -05:00
parent 00567ce72b
commit 9acf6e27c1
2 changed files with 95 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
api/project.go
View File

@@ -86,7 +86,7 @@ func (api *WebAPI) CreateProject(r *Request) {
return
}
if !isProjectCreationAuthorized(project, manager) {
if !api.isProjectCreationAuthorized(project, manager) {
logrus.WithFields(logrus.Fields{
"project": project,
}).Warn("Unauthorized project creation")
@@ -175,9 +175,14 @@ func (api *WebAPI) UpdateProject(r *Request) {
Ok: false,
Message: "Unauthorized",
}, 403)
logrus.WithError(err).WithFields(logrus.Fields{
"project": project,
}).Warn("Unauthorized project update")
return
}
if project.Chain != 0 && !isActionOnProjectAuthorized(project.Chain, manager, storage.RoleEdit, api.Database) {
r.Json(JsonResponse{
Ok: false,
Message: "Unauthorized (You need RoleEdit on the project you wish to chain tasks to)",
}, 403)
return
}
@@ -202,7 +207,7 @@ func (api *WebAPI) UpdateProject(r *Request) {
}
}
func isProjectCreationAuthorized(project *storage.Project, manager interface{}) bool {
func (api *WebAPI) isProjectCreationAuthorized(project *storage.Project, manager interface{}) bool {
if manager == nil {
return false
@@ -211,6 +216,19 @@ func isProjectCreationAuthorized(project *storage.Project, manager interface{})
if project.Public && !manager.(*storage.Manager).WebsiteAdmin {
return false
}
if project.Chain != 0 {
chainsTo := api.Database.GetProject(project.Chain)
if chainsTo == nil {
return false
}
if !isActionOnProjectAuthorized(chainsTo.Id, manager.(*storage.Manager),
storage.RoleEdit, api.Database) {
return false
}
}
return true
}