darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-08-20 14:29:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

Code added to now check service id matches the authorization token service for sending an sms.

Browse Source
This commit is contained in:
Nicholas Staples
2016-02-12 11:13:54 +00:00
parent 4865622128
commit 918c561726
2 changed files with 44 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
app/schemas.py
View File

@@ -1,4 +1,5 @@
import re
from flask import current_app
from flask_marshmallow.fields import fields
from . import ma
from . import models
@@ -102,12 +103,15 @@ class SmsTemplateNotificationSchema(SmsNotificationSchema):
@validates_schema
def validate_schema(self, data):
"""
Validate the to field is valid for this template
Validate the to field is valid for this notification
"""
from app import api_user
template_id = data.get('template', None)
template = models.Template.query.filter_by(id=template_id).first()
if template:
service = template.service
# Validate restricted service,
# restricted services can only send to one of its users.
if service.restricted:
valid = False
for usr in service.users:
@@ -116,6 +120,11 @@ class SmsTemplateNotificationSchema(SmsNotificationSchema):
break
if not valid:
raise ValidationError('Invalid phone number for restricted service', 'restricted')
# Assert the template is valid for the service which made the request.
service = api_user['client']
if service != current_app.config.get('ADMIN_CLIENT_USER_NAME'):
if template.service != models.Service.query.filter_by(id=service).first():
raise ValidationError('Invalid template', 'restricted')
class SmsAdminNotificationSchema(SmsNotificationSchema):