darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-11 09:28:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Hide ‘back to …’ link if it’s not your service

Browse Source 
This can happen if you click a link for a service you don’t have access
to. We shouldn’t show the back to service link in this case because:
- you shouldn’t be able to find out the service’s name from just knowing
  the link
- if you click the link you only get a `403` anyway
This commit is contained in:
Chris Hill-Scott
2019-01-15 17:31:55 +00:00
parent 7c92847b85
commit 558ae87baa
4 changed files with 57 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/models/user.py
View File

@@ -151,8 +151,11 @@ class User(UserMixin):
def has_permission_for_service(self, service_id, permission):
return permission in self._permissions.get(service_id, [])
def belongs_to_service(self, service_id):
return str(service_id) in self.services
def belongs_to_service_or_403(self, service_id):
if str(service_id) not in self.services:
if not self.belongs_to_service(service_id):
abort(403)
def is_locked(self):