github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-07 20:31:06 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1088 from sharelatex/ta-fix-entity-id-scope

Browse source 
Fix Scope Bug in Group Access Control

GitOrigin-RevId: 7d2cb5fc08e0c7e4bd1b70c03b62620bb7dd8d41
This commit is contained in:
Simon Detheridge 2018-10-30 10:02:30 +00:00 committed by sharelatex
parent c18ca779ba
commit 1a9bb5f4eb
2 changed files with 26 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
services/web/app/coffee/Features/UserMembership/UserMembershipAuthorization.coffee
View file

@ -6,13 +6,13 @@ Errors = require('../Errors/Errors')
logger = require("logger-sharelatex")
module.exports =
requireEntityAccess: (entityName, entityId = null) ->
requireEntityAccess: (entityName, entityIdOverride = null) ->
(req, res, next) ->
loggedInUser = AuthenticationController.getSessionUser(req)
unless loggedInUser
return AuthorizationMiddlewear.redirectToRestricted req, res, next
entityId = req.params.id unless entityId?
entityId = entityIdOverride or req.params.id
getEntity entityName, entityId, loggedInUser, (error, entity, entityConfig) ->
return next(error) if error?
unless entity?

24
services/web/test/unit/coffee/UserMembership/UserMembershipAuthorizationTests.coffee
View file

@ -73,3 +73,27 @@ describe "UserMembershipAuthorization", ->
sinon.assert.notCalled(@UserMembershipHandler.getEntity)
expect(@req.entity).to.not.exist
done()
it 'can override entity id', (done) ->
middlewear = @UserMembershipAuthorization.requireEntityAccess 'group', 'entity-id-override'
middlewear @req, null, (error) =>
expect(error).to.not.extist
sinon.assert.calledWithMatch(
@UserMembershipHandler.getEntity,
'entity-id-override',
)
done()
it "doesn't cache entity id between requests", (done) ->
middlewear = @UserMembershipAuthorization.requireEntityAccess 'group'
middlewear @req, null, (error) =>
expect(error).to.not.extist
lastCallArs = @UserMembershipHandler.getEntity.lastCall.args
expect(lastCallArs[0]).to.equal @req.params.id
newEntityId = 'another-mock-id'
@req.params.id = newEntityId
middlewear @req, null, (error) =>
expect(error).to.not.extist
lastCallArs = @UserMembershipHandler.getEntity.lastCall.args
expect(lastCallArs[0]).to.equal newEntityId
done()