teach/atsebay.t
Archived
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Don't "leak" other user keys

Browse Source
This commit is contained in:
nemunaire 2022-09-10 00:37:29 +02:00
parent ebd09e8270
commit a3e001db09
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
keys.go
View File

@ -68,6 +68,7 @@ func declareAPIAuthKeysRoutes(router *gin.RouterGroup) {
keysRoutes := router.Group("/keys/:kid") keysRoutes := router.Group("/keys/:kid")
keysRoutes.Use(keyHandler) keysRoutes.Use(keyHandler)
keysRoutes.Use(keyOnlyMyHandler)
keysRoutes.GET("", func(c *gin.Context) { keysRoutes.GET("", func(c *gin.Context) {
var u *User var u *User
@ -153,6 +154,20 @@ func keyHandler(c *gin.Context) {
} }
} }
func keyOnlyMyHandler(c *gin.Context) {
u := c.MustGet("LoggedUser").(*User)
k := c.MustGet("key").(*Key)
if u.IsAdmin {
c.Next()
} else if k.IdUser == u.Id {
c.Next()
} else {
c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"errmsg": "Key not found."})
return
}
}
type Key struct { type Key struct {
Id int64 `json:"id"` Id int64 `json:"id"`
IdUser int64 `json:"id_user"` IdUser int64 `json:"id_user"`