diff --git a/src-ui/src/app/components/dashboard/dashboard.component.spec.ts b/src-ui/src/app/components/dashboard/dashboard.component.spec.ts
index 911565526..6d100510d 100644
--- a/src-ui/src/app/components/dashboard/dashboard.component.spec.ts
+++ b/src-ui/src/app/components/dashboard/dashboard.component.spec.ts
@@ -16,6 +16,7 @@ import { IfPermissionsDirective } from 'src/app/directives/if-permissions.direct
import { NgxFileDropModule } from 'ngx-file-drop'
import { RouterTestingModule } from '@angular/router/testing'
import { TourNgBootstrapModule, TourService } from 'ngx-ui-tour-ng-bootstrap'
+import { LogoComponent } from '../common/logo/logo.component'
describe('DashboardComponent', () => {
let component: DashboardComponent
@@ -33,6 +34,7 @@ describe('DashboardComponent', () => {
UploadFileWidgetComponent,
IfPermissionsDirective,
SavedViewWidgetComponent,
+ LogoComponent,
],
providers: [
PermissionsGuard,
diff --git a/src-ui/src/app/components/document-asn/document-asn.component.spec.ts b/src-ui/src/app/components/document-asn/document-asn.component.spec.ts
index 62b1113db..c8ad0d13d 100644
--- a/src-ui/src/app/components/document-asn/document-asn.component.spec.ts
+++ b/src-ui/src/app/components/document-asn/document-asn.component.spec.ts
@@ -53,6 +53,6 @@ describe('DocumentAsnComponent', () => {
.mockReturnValue(of(convertToParamMap({ id: '5578' })))
const navigateSpy = jest.spyOn(router, 'navigate')
component.ngOnInit()
- expect(navigateSpy).toHaveBeenCalledWith(['404'])
+ expect(navigateSpy).toHaveBeenCalledWith(['404'], { replaceUrl: true })
})
})
diff --git a/src-ui/src/app/components/document-asn/document-asn.component.ts b/src-ui/src/app/components/document-asn/document-asn.component.ts
index 4fb9f474a..6003f1621 100644
--- a/src-ui/src/app/components/document-asn/document-asn.component.ts
+++ b/src-ui/src/app/components/document-asn/document-asn.component.ts
@@ -25,7 +25,9 @@ export class DocumentAsnComponent implements OnInit {
if (documentId.length == 1) {
this.router.navigate(['documents', documentId[0]])
} else {
- this.router.navigate(['404'])
+ this.router.navigate(['404'], {
+ replaceUrl: true,
+ })
}
})
})
diff --git a/src-ui/src/app/components/document-detail/document-detail.component.spec.ts b/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
index dee1435b7..bbee477cc 100644
--- a/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.spec.ts
@@ -355,14 +355,14 @@ describe('DocumentDetailComponent', () => {
.mockReturnValueOnce(throwError(() => new Error('unable to discard')))
component.discard()
fixture.detectChanges()
- expect(navigateSpy).toHaveBeenCalledWith(['404'])
+ expect(navigateSpy).toHaveBeenCalledWith(['404'], { replaceUrl: true })
})
it('should 404 on invalid id', () => {
jest.spyOn(documentService, 'get').mockReturnValueOnce(of(null))
const navigateSpy = jest.spyOn(router, 'navigate')
fixture.detectChanges()
- expect(navigateSpy).toHaveBeenCalledWith(['404'])
+ expect(navigateSpy).toHaveBeenCalledWith(['404'], { replaceUrl: true })
})
it('should support save, close and show success toast', () => {
diff --git a/src-ui/src/app/components/document-detail/document-detail.component.ts b/src-ui/src/app/components/document-detail/document-detail.component.ts
index 7a385bebe..7337028da 100644
--- a/src-ui/src/app/components/document-detail/document-detail.component.ts
+++ b/src-ui/src/app/components/document-detail/document-detail.component.ts
@@ -341,7 +341,9 @@ export class DocumentDetailComponent
this.openDocumentService.setDirty(doc, dirty)
},
error: (error) => {
- this.router.navigate(['404'])
+ this.router.navigate(['404'], {
+ replaceUrl: true,
+ })
},
})
@@ -513,7 +515,9 @@ export class DocumentDetailComponent
this.openDocumentService.setDirty(doc, false)
},
error: () => {
- this.router.navigate(['404'])
+ this.router.navigate(['404'], {
+ replaceUrl: true,
+ })
},
})
}
diff --git a/src-ui/src/app/components/document-list/document-list.component.spec.ts b/src-ui/src/app/components/document-list/document-list.component.spec.ts
index 2b14747bf..6e6dd8f6c 100644
--- a/src-ui/src/app/components/document-list/document-list.component.spec.ts
+++ b/src-ui/src/app/components/document-list/document-list.component.spec.ts
@@ -259,7 +259,7 @@ describe('DocumentListComponent', () => {
.mockReturnValue(of(convertToParamMap({ id: '10' })))
const navigateSpy = jest.spyOn(router, 'navigate')
fixture.detectChanges()
- expect(navigateSpy).toHaveBeenCalledWith(['404'])
+ expect(navigateSpy).toHaveBeenCalledWith(['404'], { replaceUrl: true })
})
it('should load saved view from query params', () => {
diff --git a/src-ui/src/app/components/document-list/document-list.component.ts b/src-ui/src/app/components/document-list/document-list.component.ts
index 32431167b..25a95401f 100644
--- a/src-ui/src/app/components/document-list/document-list.component.ts
+++ b/src-ui/src/app/components/document-list/document-list.component.ts
@@ -153,7 +153,9 @@ export class DocumentListComponent
.pipe(takeUntil(this.unsubscribeNotifier))
.subscribe(({ view }) => {
if (!view) {
- this.router.navigate(['404'])
+ this.router.navigate(['404'], {
+ replaceUrl: true,
+ })
return
}
this.unmodifiedSavedView = view
diff --git a/src-ui/src/app/components/not-found/not-found.component.html b/src-ui/src/app/components/not-found/not-found.component.html
index 913132d1b..4b4dc7c09 100644
--- a/src-ui/src/app/components/not-found/not-found.component.html
+++ b/src-ui/src/app/components/not-found/not-found.component.html
@@ -1,8 +1,17 @@
-
-
-
404 Not Found
-
+
diff --git a/src-ui/src/app/components/not-found/not-found.component.spec.ts b/src-ui/src/app/components/not-found/not-found.component.spec.ts
index 8962d833f..2a0ab9d7c 100644
--- a/src-ui/src/app/components/not-found/not-found.component.spec.ts
+++ b/src-ui/src/app/components/not-found/not-found.component.spec.ts
@@ -1,5 +1,7 @@
import { ComponentFixture, TestBed } from '@angular/core/testing'
import { NotFoundComponent } from './not-found.component'
+import { By } from '@angular/platform-browser'
+import { LogoComponent } from '../common/logo/logo.component'
describe('NotFoundComponent', () => {
let component: NotFoundComponent
@@ -7,7 +9,7 @@ describe('NotFoundComponent', () => {
beforeEach(async () => {
TestBed.configureTestingModule({
- declarations: [NotFoundComponent],
+ declarations: [NotFoundComponent, LogoComponent],
}).compileComponents()
fixture = TestBed.createComponent(NotFoundComponent)
@@ -18,6 +20,7 @@ describe('NotFoundComponent', () => {
it('should create component', () => {
expect(component).toBeTruthy()
- expect(fixture.nativeElement.textContent).toContain('404 Not Found')
+ expect(fixture.nativeElement.textContent).toContain('Not Found')
+ expect(fixture.debugElement.queryAll(By.css('a'))).toHaveLength(1)
})
})
From 3b666fef77c5c70f006c8d282825a3cd7e572af3 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Wed, 9 Aug 2023 08:52:23 -0700
Subject: [PATCH 3/3] Add backend check for ws message ownership
---
src-ui/src/app/services/consumer-status.service.ts | 2 +-
src/paperless/consumers.py | 13 ++++++++++++-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/src-ui/src/app/services/consumer-status.service.ts b/src-ui/src/app/services/consumer-status.service.ts
index 3e21da138..2b587fbfd 100644
--- a/src-ui/src/app/services/consumer-status.service.ts
+++ b/src-ui/src/app/services/consumer-status.service.ts
@@ -146,7 +146,7 @@ export class ConsumerStatusService {
this.statusWebSocket.onmessage = (ev) => {
let statusMessage: WebsocketConsumerStatusMessage = JSON.parse(ev['data'])
- // tasks are async so we rely on checking user id
+ // fallback if backend didnt restrict message
if (
statusMessage.owner_id &&
statusMessage.owner_id !== this.settingsService.currentUser?.id &&
diff --git a/src/paperless/consumers.py b/src/paperless/consumers.py
index 7c34c8c39..cf1a3b548 100644
--- a/src/paperless/consumers.py
+++ b/src/paperless/consumers.py
@@ -10,6 +10,16 @@ class StatusConsumer(WebsocketConsumer):
def _authenticated(self):
return "user" in self.scope and self.scope["user"].is_authenticated
+ def _is_owner_or_unowned(self, data):
+ return (
+ (
+ self.scope["user"].is_superuser
+ or self.scope["user"].id == data["owner_id"]
+ )
+ if "owner_id" in data and "user" in self.scope
+ else True
+ )
+
def connect(self):
if not self._authenticated():
raise DenyConnection
@@ -30,4 +40,5 @@ class StatusConsumer(WebsocketConsumer):
if not self._authenticated():
self.close()
else:
- self.send(json.dumps(event["data"]))
+ if self._is_owner_or_unowned(event["data"]):
+ self.send(json.dumps(event["data"]))