From 6f8a2721d9c3c1c17a78623068c6ec29c49524ff Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 30 Sep 2020 18:12:45 +0100 Subject: [PATCH] Tighten restrictions of which templates a user can tour with We don't want them being able to tour with a template they don't have folder permissions to see. Also, when a new user creates a service they will always have full permissions so this won't affect new services at all, it's just to stop people 'hacking' the urls to enable them to see templates they maybe shouldn't see if they knew the template ID --- app/main/views/tour.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/main/views/tour.py b/app/main/views/tour.py index 6c15de52b..c17c51bf8 100644 --- a/app/main/views/tour.py +++ b/app/main/views/tour.py @@ -15,7 +15,7 @@ from app.utils import get_template, user_has_permissions @main.route("/services//tour/") @user_has_permissions('send_messages') def begin_tour(service_id, template_id): - db_template = current_service.get_template(template_id) + db_template = current_service.get_template_with_user_permission_or_403(template_id, current_user) if (db_template['template_type'] != 'sms' or not current_user.mobile_number): abort(404) @@ -44,7 +44,7 @@ def begin_tour(service_id, template_id): ) @user_has_permissions('send_messages', restrict_admin_usage=True) def tour_step(service_id, template_id, step_index): - db_template = current_service.get_template(template_id) + db_template = current_service.get_template_with_user_permission_or_403(template_id, current_user) if db_template['template_type'] != 'sms': abort(404) @@ -111,7 +111,7 @@ def _get_tour_step_back_link(service_id, template_id, step_index): @main.route("/services//tour//check", methods=['GET']) @user_has_permissions('send_messages', restrict_admin_usage=True) def check_tour_notification(service_id, template_id): - db_template = current_service.get_template(template_id) + db_template = current_service.get_template_with_user_permission_or_403(template_id, current_user) template = get_template( db_template,