paradizelost/paperless-ngx
1
0
Fork 0
mirror of https://github.com/paperless-ngx/paperless-ngx.git synced 2025-04-02 13:45:10 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix: enforce object permissions for app config (#5516)

Browse Source
This commit is contained in:
shamoon 2024-01-23 12:23:15 -08:00 committed by GitHub
parent 6651c80fb9
commit 88ae60a4a0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src-ui/src/app/app-routing.module.ts
View File

@ -186,8 +186,8 @@ export const routes: Routes = [
canActivate: [PermissionsGuard], canActivate: [PermissionsGuard],
data: { data: {
requiredPermission: { requiredPermission: {
action: PermissionAction.View, action: PermissionAction.Change,
type: PermissionType.Admin, type: PermissionType.AppConfig,
}, },
}, },
}, },

2
src-ui/src/app/components/app-frame/app-frame.component.html
View File

@ -235,7 +235,7 @@
<i-bs class="me-1" name="gear"></i-bs><span>&nbsp;<ng-container i18n>Settings</ng-container></span> <i-bs class="me-1" name="gear"></i-bs><span>&nbsp;<ng-container i18n>Settings</ng-container></span>
</a> </a>
</li> </li>
<li class="nav-item" *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Admin }"> <li class="nav-item" *pngxIfPermissions="{ action: PermissionAction.Change, type: PermissionType.AppConfig }">
<a class="nav-link" routerLink="config" routerLinkActive="active" (click)="closeMenu()" <a class="nav-link" routerLink="config" routerLinkActive="active" (click)="closeMenu()"
ngbPopover="Configuration" i18n-ngbPopover [disablePopover]="!slimSidebarEnabled" placement="end" ngbPopover="Configuration" i18n-ngbPopover [disablePopover]="!slimSidebarEnabled" placement="end"
container="body" triggers="mouseenter:mouseleave" popoverClass="popover-slim"> container="body" triggers="mouseenter:mouseleave" popoverClass="popover-slim">

4
src-ui/src/app/services/permissions.service.spec.ts
View File

@ -260,6 +260,10 @@ describe('PermissionsService', () => {
'view_customfield', 'view_customfield',
'change_customfield', 'change_customfield',
'delete_customfield', 'delete_customfield',
'add_applicationconfiguration',
'change_applicationconfiguration',
'delete_applicationconfiguration',
'view_applicationconfiguration',
], ],
{ {
username: 'testuser', username: 'testuser',

1
src-ui/src/app/services/permissions.service.ts
View File

@ -17,6 +17,7 @@ export enum PermissionType {
StoragePath = '%s_storagepath', StoragePath = '%s_storagepath',
SavedView = '%s_savedview', SavedView = '%s_savedview',
PaperlessTask = '%s_paperlesstask', PaperlessTask = '%s_paperlesstask',
AppConfig = '%s_applicationconfiguration',
UISettings = '%s_uisettings', UISettings = '%s_uisettings',
Note = '%s_note', Note = '%s_note',
MailAccount = '%s_mailaccount', MailAccount = '%s_mailaccount',

3
src/paperless/views.py
View File

@ -11,6 +11,7 @@ from rest_framework.authtoken.models import Token
from rest_framework.filters import OrderingFilter from rest_framework.filters import OrderingFilter
from rest_framework.generics import GenericAPIView from rest_framework.generics import GenericAPIView
from rest_framework.pagination import PageNumberPagination from rest_framework.pagination import PageNumberPagination
from rest_framework.permissions import DjangoObjectPermissions
from rest_framework.permissions import IsAuthenticated from rest_framework.permissions import IsAuthenticated
from rest_framework.response import Response from rest_framework.response import Response
from rest_framework.viewsets import ModelViewSet from rest_framework.viewsets import ModelViewSet
@ -166,4 +167,4 @@ class ApplicationConfigurationViewSet(ModelViewSet):
queryset = ApplicationConfiguration.objects queryset = ApplicationConfiguration.objects
serializer_class = ApplicationConfigurationSerializer serializer_class = ApplicationConfigurationSerializer
permission_classes = (IsAuthenticated,) permission_classes = (IsAuthenticated, DjangoObjectPermissions)