Protect Routes #292

MarioRodrigues10 · 2023-07-23T17:24:19Z

This PR belongs to @joaodiaslobo , in order to merge this quicker i fixed some tests and open it because @joaodiaslobo will be out of town for a week and we can't delay this feature much more.

…utes

…protect-routes

…utes

ruilopesm · 2023-07-24T11:43:22Z

lib/atomic_web/live/activity_live/edit.ex

+       |> assign(:page_title, gettext("Edit Activity"))
+       |> assign(:activity, activity)}
+    else
+      raise AtomicWeb.MismatchError


Why are you raising an exception on an handle_params function?

I think what he is doing is raising an exception making the current request fail with 404 status, which automatically shows the 404 page. Smart

Hmm, I see. Why not wrap this logic inside a function and call it on a Plug implemented at the route level? That way, we could also use that function when deciding to display (or not) the "Edit" button on the show of an activity. Agreed? 🙏

Edit: This was supposed to be a reply to the already created thread 😅

I think that is a good idea. Will clean up the code quite a bit

ruioliveira02

lib/atomic/activities/speaker.ex

ruioliveira02 · 2023-07-24T14:42:56Z

lib/atomic_web/live/activity_live/edit.ex

+       |> assign(:page_title, gettext("Edit Activity"))
+       |> assign(:activity, activity)}
+    else
+      raise AtomicWeb.MismatchError


I think what he is doing is raising an exception making the current request fail with 404 status, which automatically shows the 404 page. Smart

lib/atomic/activities.ex

lib/atomic_web/controllers/user_auth.ex

lib/atomic_web/live/activity_live/edit.ex

ruilopesm · 2023-07-25T20:51:58Z

lib/atomic_web/live/activity_live/edit.ex

+       |> assign(:page_title, gettext("Edit Activity"))
+       |> assign(:activity, activity)}
+    else
+      raise AtomicWeb.MismatchError


Hmm, I see. Why not wrap this logic inside a function and call it on a Plug implemented at the route level? That way, we could also use that function when deciding to display (or not) the "Edit" button on the show of an activity. Agreed? 🙏

Edit: This was supposed to be a reply to the already created thread 😅

lib/atomic/activities.ex

lib/atomic/organizations.ex

ruioliveira02

There are two ways to go about this. We can fix this right now, or merge this and make it a problem for the person implementing that page

ruioliveira02

🚀

joaodiaslobo added 30 commits July 5, 2023 15:59

Initial role based routing

6e6b893

Add membership status to conn assigns to retrieve role and protect ro…

582f36e

…utes

Add organization parameter to department routes

80b03ce

Initial role based routing

75bafae

Add membership status to conn assigns to retrieve role and protect ro…

feebe5a

…utes

Add organization parameter to department routes

237d1ab

Merge branch 'jl/protect-routes' of github.com:cesium/atomic into jl/…

75dff21

…protect-routes

Fix issues regarding previous rebase

a849e37

Check for parameters mismatch and trigger 404

3a558fb

Add organization parameter to partnership routes

075b5c0

Change organization routes id parameter's name

f07ca2b

Change membership routes and detect id mismatches

4956113

Remove duplicate routes

9c43972

Add organization_id param to activity routes

756263e

Filter activities by organization

d650934

Add organization parameter to speaker routes

b9539d5

Change board routes and check for id mismatches

a475878

Initial role based routing

3cb3da0

Add membership status to conn assigns to retrieve role and protect ro…

31d0e56

…utes

Add organization parameter to department routes

f7a275b

Initial role based routing

b528b79

Add membership status to conn assigns to retrieve role and protect ro…

7dcd54a

…utes

Add organization parameter to department routes

02423dc

Fix issues regarding previous rebase

6f51255

Check for parameters mismatch and trigger 404

43fc3f9

Add organization parameter to partnership routes

015b71e

Change organization routes id parameter's name

161f226

Change membership routes and detect id mismatches

8f6d8cd

Remove duplicate routes

a4205fc

Add organization_id param to activity routes

bfad6e5

joaodiaslobo and others added 6 commits July 15, 2023 00:10

Run formatter

cba4774

Solve warnings

1c1187a

Update routes and add authorization

b4ce9fc

Keep organization state trough routes

e94d326

Fix tests

b155ca7

Fix warnings

a7f3908

MarioRodrigues10 requested review from ruioliveira02 and ruilopesm July 23, 2023 17:24

MarioRodrigues10 assigned joaodiaslobo Jul 23, 2023

ruilopesm reviewed Jul 24, 2023

View reviewed changes

ruioliveira02 reviewed Jul 24, 2023

View reviewed changes

ruilopesm reviewed Jul 25, 2023

View reviewed changes

Add some improvements

0825507

MarioRodrigues10 force-pushed the jl/protect-routes branch from 43a7b2c to 0825507 Compare July 26, 2023 00:00

MarioRodrigues10 requested review from ruioliveira02 and ruilopesm July 26, 2023 09:29

Add field default_organization_id

290bcbe

MarioRodrigues10 force-pushed the jl/protect-routes branch from d5ddbb8 to 290bcbe Compare July 26, 2023 09:31

Solve minor root.html.heex problem

5edc4eb

ruioliveira02 reviewed Jul 27, 2023

View reviewed changes

lib/atomic/activities.ex Outdated Show resolved Hide resolved

lib/atomic/activities.ex Outdated Show resolved Hide resolved

lib/atomic/organizations.ex Outdated Show resolved Hide resolved

Implement suggestions

f27aafb

ruioliveira02 reviewed Jul 27, 2023

View reviewed changes

MarioRodrigues10 force-pushed the jl/protect-routes branch from 6ea76ee to f27aafb Compare July 27, 2023 11:35

Fix function

b710af3

MarioRodrigues10 requested a review from ruioliveira02 July 28, 2023 21:07

MarioRodrigues10 enabled auto-merge (squash) July 28, 2023 21:08

ruioliveira02 approved these changes Jul 28, 2023

View reviewed changes

MarioRodrigues10 merged commit 8e5780c into develop Jul 28, 2023
2 checks passed

MarioRodrigues10 deleted the jl/protect-routes branch July 28, 2023 21:40

joaodiaslobo mentioned this pull request Sep 12, 2023

Security flaw with routes protection #414

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Protect Routes #292

Protect Routes #292

MarioRodrigues10 commented Jul 23, 2023 •

edited

Loading

ruilopesm Jul 24, 2023

ruioliveira02 Jul 24, 2023

ruilopesm Jul 25, 2023 •

edited

Loading

ruioliveira02 Jul 25, 2023

ruioliveira02 left a comment

ruioliveira02 Jul 24, 2023

ruilopesm Jul 25, 2023 •

edited

Loading

ruioliveira02 left a comment

ruioliveira02 left a comment

Protect Routes #292

Protect Routes #292

Conversation

MarioRodrigues10 commented Jul 23, 2023 • edited Loading

ruilopesm Jul 24, 2023

Choose a reason for hiding this comment

ruioliveira02 Jul 24, 2023

Choose a reason for hiding this comment

ruilopesm Jul 25, 2023 • edited Loading

Choose a reason for hiding this comment

ruioliveira02 Jul 25, 2023

Choose a reason for hiding this comment

ruioliveira02 left a comment

Choose a reason for hiding this comment

ruioliveira02 Jul 24, 2023

Choose a reason for hiding this comment

ruilopesm Jul 25, 2023 • edited Loading

Choose a reason for hiding this comment

ruioliveira02 left a comment

Choose a reason for hiding this comment

ruioliveira02 left a comment

Choose a reason for hiding this comment

MarioRodrigues10 commented Jul 23, 2023 •

edited

Loading

ruilopesm Jul 25, 2023 •

edited

Loading

ruilopesm Jul 25, 2023 •

edited

Loading