marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed stop schedule access rights

Browse Source
This commit is contained in:
frikky
2021-05-07 10:44:36 +02:00
parent 04216d960f
commit 891dd1696f
6 changed files with 258 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/walkoff.go
+21 -6
View File
@@ -2360,15 +2360,30 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) {
return
}
// FIXME - have a check for org etc too..
// FIXME - admin check like this? idk
if user.Id != workflow.Owner && user.Role != "scheduler" {
log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`))
return
if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" {
log.Printf("[DEBUG] User %s is accessing workflow %s as admin", user.Username, workflow.ID)
} else {
log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`))
return
}
}
//if user.Id != workflow.Owner || len(user.Id) == 0 {
// if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" {
// log.Printf("[INFO] User %s is accessing workflow %s as admin", user.Username, workflow.ID)
// } else if workflow.Public {
// log.Printf("[INFO] Letting user %s access workflow %s because it's public", user.Username, workflow.ID)
// } else {
// log.Printf("[WARNING] Wrong user (%s) for workflow %s (get workflow)", user.Username, workflow.ID)
// resp.WriteHeader(401)
// resp.Write([]byte(`{"success": false}`))
// return
// }
//}
schedule, err := shuffle.GetSchedule(ctx, scheduleId)
if err != nil {
log.Printf("[WARNING] Failed finding schedule %s", scheduleId)