ami/tl-vikunja
1
0
Fork 0
Code

fix(attachments): check permissions when accessing all attachments

Browse Source 
(cherry picked from commit 3659b7b58d4405452f3e806e12b0e3dfb4577503)
This commit is contained in:
kolaente 2024-11-21 15:42:53 +01:00
parent a0d05211ff
commit 714298a94e
No known key found for this signature in database
GPG Key ID: F40E70337AB24C9B
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/models/task_attachment.go
View File

@ -132,7 +132,16 @@ func (ta *TaskAttachment) ReadOne(s *xorm.Session, _ web.Auth) (err error) {
// @Failure 404 {object} models.Message "The task does not exist." // @Failure 404 {object} models.Message "The task does not exist."
// @Failure 500 {object} models.Message "Internal error" // @Failure 500 {object} models.Message "Internal error"
// @Router /tasks/{id}/attachments [get] // @Router /tasks/{id}/attachments [get]
func (ta *TaskAttachment) ReadAll(s *xorm.Session, _ web.Auth, _ string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error) { func (ta *TaskAttachment) ReadAll(s *xorm.Session, a web.Auth, _ string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error) {
task := Task{ID: ta.TaskID}
canRead, _, err := task.CanRead(s, a)
if err != nil {
return nil, 0, 0, err
}
if !canRead {
return nil, 0, 0, ErrGenericForbidden{}
}
attachments := []*TaskAttachment{} attachments := []*TaskAttachment{}
limit, start := getLimitFromPageIndex(page, perPage) limit, start := getLimitFromPageIndex(page, perPage)