Skip to content

Commit

Permalink
fix(api): action name can contain space (#6279)
Browse files Browse the repository at this point in the history
  • Loading branch information
@sguiheux
sguiheux authored Sep 23, 2022
1 parent b309ce9 commit 96fdec6
Show file tree
Hide file tree
Showing 2 changed files with 71 additions and 11 deletions.
67 changes: 58 additions & 9 deletions engine/api/action.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"context"
"io"
"net/http"
"net/url"

"github.com/go-gorp/gorp"
"github.com/gorilla/mux"
Expand Down Expand Up @@ -186,7 +187,12 @@ func (api *API) getActionHandler() service.Handler {
vars := mux.Vars(r)

groupName := vars["permGroupName"]
actionName := vars["permActionName"]
actionNameEscaped := vars["permActionName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

g, err := group.LoadByName(ctx, api.mustDB(), groupName, group.LoadOptions.WithMembers)
if err != nil {
Expand Down Expand Up @@ -221,7 +227,13 @@ func (api *API) putActionHandler() service.Handler {
vars := mux.Vars(r)

groupName := vars["permGroupName"]
actionName := vars["permActionName"]

actionNameEscaped := vars["permActionName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

g, err := group.LoadByName(ctx, api.mustDB(), groupName)
if err != nil {
Expand Down Expand Up @@ -318,7 +330,13 @@ func (api *API) deleteActionHandler() service.Handler {
vars := mux.Vars(r)

groupName := vars["permGroupName"]
actionName := vars["permActionName"]

actionNameEscaped := vars["permActionName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

g, err := group.LoadByName(ctx, api.mustDB(), groupName)
if err != nil {
Expand Down Expand Up @@ -364,7 +382,13 @@ func (api *API) getActionAuditHandler() service.Handler {
vars := mux.Vars(r)

groupName := vars["permGroupName"]
actionName := vars["permActionName"]

actionNameEscaped := vars["permActionName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

g, err := group.LoadByName(ctx, api.mustDB(), groupName)
if err != nil {
Expand Down Expand Up @@ -440,7 +464,12 @@ func (api *API) postActionAuditRollbackHandler() service.Handler {
vars := mux.Vars(r)

groupName := vars["permGroupName"]
actionName := vars["permActionName"]
actionNameEscaped := vars["permActionName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

auditID, err := requestVarInt(r, "auditID")
if err != nil {
Expand Down Expand Up @@ -575,7 +604,12 @@ func (api *API) getActionUsageHandler() service.Handler {
vars := mux.Vars(r)

groupName := vars["permGroupName"]
actionName := vars["permActionName"]
actionNameEscaped := vars["permActionName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

g, err := group.LoadByName(ctx, api.mustDB(), groupName)
if err != nil {
Expand Down Expand Up @@ -604,7 +638,12 @@ func (api *API) getActionExportHandler() service.Handler {
vars := mux.Vars(r)

groupName := vars["permGroupName"]
actionName := vars["permActionName"]
actionNameEscaped := vars["permActionName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

format := FormString(r, "format")
if format == "" {
Expand Down Expand Up @@ -800,7 +839,12 @@ func (api *API) getActionBuiltinHandler() service.Handler {
return func(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
vars := mux.Vars(r)

actionName := vars["permActionBuiltinName"]
actionNameEscaped := vars["permActionBuiltinName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, actionName,
action.LoadOptions.WithRequirements,
Expand All @@ -822,7 +866,12 @@ func (api *API) getActionBuiltinUsageHandler() service.Handler {
return func(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
vars := mux.Vars(r)

actionName := vars["permActionBuiltinName"]
actionNameEscaped := vars["permActionBuiltinName"]

actionName, err := url.PathUnescape(actionNameEscaped)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, actionName,
action.LoadOptions.WithRequirements,
Expand Down
15 changes: 13 additions & 2 deletions engine/api/router_middleware_auth_permission.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package api
import (
"context"
"net/http"
"net/url"
"strconv"

"github.com/rockbears/log"
Expand Down Expand Up @@ -406,7 +407,12 @@ func (api *API) checkActionPermissions(ctx context.Context, w http.ResponseWrite
return err
}

a, err := action.LoadTypeDefaultByNameAndGroupID(ctx, api.mustDB(), actionName, g.ID)
name, err := url.PathUnescape(actionName)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

a, err := action.LoadTypeDefaultByNameAndGroupID(ctx, api.mustDB(), name, g.ID)
if err != nil {
return err
}
Expand All @@ -422,7 +428,12 @@ func (api *API) checkActionBuiltinPermissions(ctx context.Context, w http.Respon
return sdk.WrapError(sdk.ErrWrongRequest, "invalid given action name")
}

a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, actionName)
name, err := url.PathUnescape(actionName)
if err != nil {
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
}

a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, name)
if err != nil {
return err
}
Expand Down

0 comments on commit 96fdec6

Please sign in to comment.