marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#330: Fixed issue where user can't execute other users' workflow

Browse Source
This commit is contained in:
frikky
2021-04-03 22:09:09 +02:00
parent d33ffe8a83
commit 0aa5d95580
2 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/main.go
+2 -2
View File
@@ -861,8 +861,8 @@ func createNewUser(username, password, role, apikey string, org shuffle.OrgMini)
q := datastore.NewQuery("Users").Filter("Username =", username) q := datastore.NewQuery("Users").Filter("Username =", username)
var users []shuffle.User var users []shuffle.User
_, err = dbclient.GetAll(ctx, q, &users) _, err = dbclient.GetAll(ctx, q, &users)
if err != nil { if err != nil && len(users) == 0 {
log.Printf("Failed getting user for registration: %s", err) log.Printf("[WARNING] Failed getting user for registration: %s", err)
return err return err
} }
backend/go-app/walkoff.go
+12 -7
View File
@@ -2076,19 +2076,20 @@ func handleExecution(id string, workflow shuffle.Workflow, request *http.Request
} }
//log.Printf("Execution data: %#v", execution) //log.Printf("Execution data: %#v", execution)
if len(execution.Start) == 36 { if len(execution.Start) == 36 && len(workflow.Actions) > 0 {
log.Printf("[INFO] Should start execution on node %s", execution.Start) log.Printf("[INFO] Should start execution on node %s", execution.Start)
workflowExecution.Start = execution.Start workflowExecution.Start = execution.Start
found := false found := false
for _, action := range workflow.Actions { for _, action := range workflow.Actions {
if action.ID == workflow.Start { if action.ID == execution.Start {
found = true found = true
break
} }
} }
if !found { if !found {
log.Printf("[ERROR] ACTION %s WAS NOT FOUND!", workflow.Start) log.Printf("[ERROR] ACTION %s WAS NOT FOUND!", execution.Start)
return shuffle.WorkflowExecution{}, fmt.Sprintf("Startnode %s was not found in actions", workflow.Start), errors.New(fmt.Sprintf("Startnode %s was not found in actions", workflow.Start)) return shuffle.WorkflowExecution{}, fmt.Sprintf("Startnode %s was not found in actions", workflow.Start), errors.New(fmt.Sprintf("Startnode %s was not found in actions", workflow.Start))
} }
} else if len(execution.Start) > 0 { } else if len(execution.Start) > 0 {
@@ -2708,10 +2709,14 @@ func executeWorkflow(resp http.ResponseWriter, request *http.Request) {
// FIXME - have a check for org etc too.. // FIXME - have a check for org etc too..
// FIXME - admin check like this? idk // FIXME - admin check like this? idk
if user.Id != workflow.Owner && user.Role != "scheduler" && user.Role != fmt.Sprintf("workflow_%s", fileId) { if user.Id != workflow.Owner && user.Role != "scheduler" && user.Role != fmt.Sprintf("workflow_%s", fileId) {
log.Printf("Wrong user (%s) for workflow %s (execute)", user.Username, workflow.ID) if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" {
resp.WriteHeader(401) log.Printf("[INFO] Letting user %s execute %s because they're admin of the same org", user.Username, workflow.ID)
resp.Write([]byte(`{"success": false}`)) } else {
return log.Printf("[WARNING] Wrong user (%s) for workflow %s (execute)", user.Username, workflow.ID)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`))
return
}
} }
log.Printf("[INFO] Starting execution of %s!", fileId) log.Printf("[INFO] Starting execution of %s!", fileId)