darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-04 13:41:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

Tighten restrictions of which templates a user can tour with

Browse Source 
We don't want them being able to tour with a template they don't have
folder permissions to see.

Also, when a new user creates a service they will always have full
permissions so this won't affect new services at all, it's just to stop
people 'hacking' the urls to enable them to see templates they maybe
shouldn't see if they knew the template ID
This commit is contained in:
David McDonald
2020-09-30 18:12:45 +01:00
parent ec0af6b151
commit 6f8a2721d9
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/main/views/tour.py
View File

@@ -15,7 +15,7 @@ from app.utils import get_template, user_has_permissions
@main.route("/services/<uuid:service_id>/tour/<uuid:template_id>")
@user_has_permissions('send_messages')
def begin_tour(service_id, template_id):
db_template = current_service.get_template(template_id)
db_template = current_service.get_template_with_user_permission_or_403(template_id, current_user)
if (db_template['template_type'] != 'sms' or not current_user.mobile_number):
abort(404)
@@ -44,7 +44,7 @@ def begin_tour(service_id, template_id):
)
@user_has_permissions('send_messages', restrict_admin_usage=True)
def tour_step(service_id, template_id, step_index):
db_template = current_service.get_template(template_id)
db_template = current_service.get_template_with_user_permission_or_403(template_id, current_user)
if db_template['template_type'] != 'sms':
abort(404)
@@ -111,7 +111,7 @@ def _get_tour_step_back_link(service_id, template_id, step_index):
@main.route("/services/<uuid:service_id>/tour/<uuid:template_id>/check", methods=['GET'])
@user_has_permissions('send_messages', restrict_admin_usage=True)
def check_tour_notification(service_id, template_id):
db_template = current_service.get_template(template_id)
db_template = current_service.get_template_with_user_permission_or_403(template_id, current_user)
template = get_template(
db_template,