Mirrored_Repos/crafty-4
1
0
Fork 0
mirror of https://gitlab.com/crafty-controller/crafty-4.git synced 2024-08-30 18:23:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix api key permission logic issue

Browse Source
This commit is contained in:
Andrew 2022-06-18 17:40:50 -04:00
parent 464428ea7e
commit 9569e760c9
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/classes/web/panel_handler.py
View File

@ -1898,7 +1898,7 @@ class PanelHandler(BaseHandler):
self.redirect("/panel/error?error=Invalid User ID")
return
if user_id != exec_user["user_id"] or not exec_user["superuser"]:
if str(user_id) != str(exec_user["user_id"]) and not exec_user["superuser"]:
self.redirect(
"/panel/error?error=You do not have access to change"
+ "this user's api key."
@ -2162,7 +2162,7 @@ class PanelHandler(BaseHandler):
key_obj = self.controller.users.get_user_api_key(key_id)
if key_obj.user_id != exec_user["user_id"] or not exec_user["superuser"]:
if key_obj.user_id != exec_user["user_id"] and not exec_user["superuser"]:
self.redirect(
"/panel/error?error=You do not have access to change"
+ "this user's api key."
@ -2178,7 +2178,8 @@ class PanelHandler(BaseHandler):
server_id=0,
source_ip=self.get_remote_ip(),
)
self.redirect("/panel/panel_config")
self.finish()
self.redirect(f"/panel/edit_user_apikeys?id={key_obj.user_id}")
else:
self.set_status(404)
self.render(