Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

FIX: add support for missing verbs in user api key 

Previously "write" scope was missing put and delete verbs which should be
allowed.

Also closes: #6982
This commit is contained in:
Sam 2019-02-13 15:49:25 +11:00
parent 1328a127ee
commit 641b079c78
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/models/user_api_key.rb
View File

@ -2,7 +2,7 @@ class UserApiKey < ActiveRecord::Base
SCOPES = { SCOPES = {
read: [:get], read: [:get],
write: [:get, :post, :patch], write: [:get, :post, :patch, :put, :delete],
message_bus: [[:post, 'message_bus']], message_bus: [[:post, 'message_bus']],
push: nil, push: nil,
notifications: [[:post, 'message_bus'], [:get, 'notifications#index'], [:put, 'notifications#mark_read']], notifications: [[:post, 'message_bus'], [:get, 'notifications#index'], [:put, 'notifications#mark_read']],
@ -29,7 +29,6 @@ class UserApiKey < ActiveRecord::Base
verb, action = permission verb, action = permission
actual_verb = env["REQUEST_METHOD"] || "" actual_verb = env["REQUEST_METHOD"] || ""
# safe in Ruby 2.3 which is only one supported
return false unless actual_verb.downcase == verb.to_s return false unless actual_verb.downcase == verb.to_s
return true unless action return true unless action

13
spec/models/user_api_key_spec.rb
View File

@ -16,9 +16,20 @@ describe UserApiKey do
end end
it "can allow all correct scopes to write" do
key = UserApiKey.new(scopes: ["write"])
expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "GET")).to eq(true)
expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "PUT")).to eq(true)
expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "PATCH")).to eq(true)
expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "DELETE")).to eq(true)
expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "POST")).to eq(true)
end
it "can allow blanket read" do it "can allow blanket read" do
key = UserApiKey.new(scopes: ['read']) key = UserApiKey.new(scopes: ["read"])
expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "GET")).to eq(true) expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "GET")).to eq(true)
expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "PUT")).to eq(false) expect(key.allow?("PATH_INFO" => "/random", "REQUEST_METHOD" => "PUT")).to eq(false)