darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-02-01 07:35:34 -05:00
Code Issues Packages Projects Releases Wiki Activity

Always use both folder and service ID when getting template folder

Browse Source 
Currently there aren't any permission checks based on folder IDs in
the admin app or the API, so it's possible for a user to modify the
folder ID to perform operations on folders outside their service.

Our usual way to avoid this is to always use service_id filter when
fetching objects from the database.
This commit is contained in:
Alexey Bezhan
2018-11-07 13:48:18 +00:00
parent 1dbb24065d
commit 36f41c23e1
3 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/dao/template_folder_dao.py
View File

@@ -3,8 +3,11 @@ from app.dao.dao_utils import transactional
from app.models import TemplateFolder
def dao_get_template_folder_by_id(template_folder_id):
return TemplateFolder.query.filter(TemplateFolder.id == template_folder_id).one()
def dao_get_template_folder_by_id_and_service_id(template_folder_id, service_id):
return TemplateFolder.query.filter(
TemplateFolder.id == template_folder_id,
TemplateFolder.service_id == service_id
).one()
@transactional