Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

workflow trimming driver should check auth on edit #16592

Closed
deanmarcussen opened this issue Aug 20, 2024 · 0 comments · Fixed by #16593
Closed

workflow trimming driver should check auth on edit #16592

deanmarcussen opened this issue Aug 20, 2024 · 0 comments · Fixed by #16593
Labels

Comments

@deanmarcussen
Copy link
Member

just saw this in our code when I was fixing something else. can't 100% remember, but aren't the site drivers supposed to check permissions in the edit method as well.

    public override IDisplayResult Edit(ISite site, WorkflowTrimmingSettings settings, BuildEditorContext context)
    {
<!-- supposed to check auth here as well -->
        return Initialize<WorkflowTrimmingViewModel>("WorkflowTrimming_Fields_Edit", async model =>
        {
            model.RetentionDays = settings.RetentionDays;
            model.LastRunUtc = (await _workflowTrimmingStateDocumentManager.GetOrCreateImmutableAsync()).LastRunUtc;
            model.Disabled = settings.Disabled;

            foreach (var status in settings.Statuses ?? [])
            {
                model.Statuses.Single(statusItem => statusItem.Status == status).IsSelected = true;
            }
        }).Location("Content:5")
        .OnGroup(GroupId);
    }

    public override async Task<IDisplayResult> UpdateAsync(ISite site, WorkflowTrimmingSettings settings, UpdateEditorContext context)
    {
        if (!await _authorizationService.AuthorizeAsync(_httpContextAccessor.HttpContext?.User, Permissions.ManageWorkflowSettings))
        {
            return null;
        }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant