From d787d1c3507bf6c6fc2ecfffe7cde2e64ec5e789 Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Wed, 7 Sep 2022 21:33:54 +0200 Subject: [PATCH 1/3] Harden works and surveys routes --- surveys.go | 15 +++++++++++++++ works.go | 19 ++++++++++++++++++- 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/surveys.go b/surveys.go index 63e514f..d5091f5 100644 --- a/surveys.go +++ b/surveys.go @@ -52,6 +52,7 @@ func declareAPISurveysRoutes(router *gin.RouterGroup) { surveysRoutes := router.Group("/surveys/:sid") surveysRoutes.Use(surveyHandler) + surveysRoutes.Use(surveyUserAccessHandler) surveysRoutes.GET("", func(c *gin.Context) { u := c.MustGet("LoggedUser").(*User) @@ -198,6 +199,20 @@ func surveyHandler(c *gin.Context) { } } +func surveyUserAccessHandler(c *gin.Context) { + u := c.MustGet("LoggedUser").(*User) + w := c.MustGet("survey").(*Survey) + + if u.IsAdmin { + c.Next() + } else if w.Shown && (w.Group == "" || strings.Contains(u.Groups, ","+w.Group+",")) { + c.Next() + } else { + c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"errmsg": "Survey not found."}) + return + } +} + type Survey struct { Id int64 `json:"id"` Title string `json:"title"` diff --git a/works.go b/works.go index f318741..248e35c 100644 --- a/works.go +++ b/works.go @@ -190,6 +190,7 @@ func declareAPIAdminWorksRoutes(router *gin.RouterGroup) { func declareAPIAuthWorksRoutes(router *gin.RouterGroup) { worksRoutes := router.Group("/works/:wid") worksRoutes.Use(workHandler) + worksRoutes.Use(workUserAccessHandler) worksRoutes.GET("", func(c *gin.Context) { u := c.MustGet("LoggedUser").(*User) @@ -209,7 +210,9 @@ func declareAPIAuthWorksRoutes(router *gin.RouterGroup) { u := c.MustGet("LoggedUser").(*User) w := c.MustGet("work").(*Work) - if g, err := u.GetMyWorkGrade(w); err != nil && errors.Is(err, sql.ErrNoRows) { + if !u.IsAdmin && !w.Corrected { + c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"errmsg": "Permission denied"}) + } else if g, err := u.GetMyWorkGrade(w); err != nil && errors.Is(err, sql.ErrNoRows) { c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"errmsg": "Aucune note n'a été attribuée pour ce travail. Avez-vous rendu ce travail ?"}) } else if err != nil { log.Printf("Unable to GetMyWorkGrade(uid=%d;wid=%d): %s", u.Id, w.Id, err.Error()) @@ -236,6 +239,20 @@ func workHandler(c *gin.Context) { } } +func workUserAccessHandler(c *gin.Context) { + u := c.MustGet("LoggedUser").(*User) + w := c.MustGet("work").(*Work) + + if u.IsAdmin { + c.Next() + } else if w.Shown && (w.Group == "" || strings.Contains(u.Groups, ","+w.Group+",")) { + c.Next() + } else { + c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"errmsg": "Work not found."}) + return + } +} + type OneWork struct { Kind string `json:"kind"` Id int64 `json:"id"` From b119fe5da460d687029706a3f20bc4b6e04380cb Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Wed, 7 Sep 2022 21:36:40 +0200 Subject: [PATCH 2/3] Disable button if no repo selected --- ui/src/components/WorkRepository.svelte | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui/src/components/WorkRepository.svelte b/ui/src/components/WorkRepository.svelte index 682f3a6..859721c 100644 --- a/ui/src/components/WorkRepository.svelte +++ b/ui/src/components/WorkRepository.svelte @@ -175,7 +175,7 @@ From 87d60c5fd503852b7702338047991410bbcfd04c Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Wed, 7 Sep 2022 21:41:20 +0200 Subject: [PATCH 3/3] Try to clarify webhook usage --- ui/src/components/WorkRepository.svelte | 13 ++++++++----- ui/src/routes/works/[wid]/index.svelte | 3 +-- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/ui/src/components/WorkRepository.svelte b/ui/src/components/WorkRepository.svelte index 859721c..d376fd8 100644 --- a/ui/src/components/WorkRepository.svelte +++ b/ui/src/components/WorkRepository.svelte @@ -82,17 +82,20 @@ {#each repos as repo (repo.id)}
-
+
- -
+ +
+

+ Vous pouvez ajouter un webhook sur les Tag push events afin d'automatiser la récupération de votre travail. Dans les paramètres de votre dépôt sur GitLab, faite pointer un webhook sur https://lessons.nemunai.re/api/callbacks/trigger.json avec le secret ci-dessous. +

- -
+ +