Mirrored_Repos/crafty-4
1
0
Fork 0
mirror of https://gitlab.com/crafty-controller/crafty-4.git synced 2024-08-30 18:23:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix issue where any user could add/remove api keys

Browse Source
This commit is contained in:
Andrew 2022-06-18 16:55:39 -04:00
parent fd0da1ef20
commit 72f97e4ff0
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
app/classes/web/panel_handler.py
View File

@ -1893,6 +1893,13 @@ class PanelHandler(BaseHandler):
self.redirect("/panel/error?error=Invalid User ID")
return
if user_id != exec_user["user_id"] or not exec_user["superuser"]:
self.redirect(
"/panel/error?error=You do not have access to change"
+ "this user's api key."
)
return
crafty_permissions_mask = self.get_perms()
server_permissions_mask = self.get_perms_server()
@ -2148,6 +2155,15 @@ class PanelHandler(BaseHandler):
self.redirect("/panel/error?error=Invalid Key ID")
return
key_obj = self.controller.users.get_user_api_key(key_id)
if key_obj.user_id != exec_user["user_id"] or not exec_user["superuser"]:
self.redirect(
"/panel/error?error=You do not have access to change"
+ "this user's api key."
)
return
self.controller.users.delete_user_api_key(key_id)
self.controller.management.add_to_audit_log(