DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2024-12-25 13:44:06 -08:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Merge pull request #11842 from snipe/security/license_file_access

Browse source 
Check for `licenses.files` permissions
This commit is contained in:
snipe 2022-09-16 14:19:37 -07:00 committed by GitHub
parent 9cae4f1d1b f75d348dc0
commit 9369165007
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 25 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/Http/Controllers/Licenses/LicenseFilesController.php
View file

@ -135,6 +135,7 @@ class LicenseFilesController extends Controller
// the license is valid
if (isset($license->id)) {
$this->authorize('view', $license);
$this->authorize('licenses.files', $license);
if (! $log = Actionlog::find($fileId)) {
return response('No matching record for that asset/file', 500)
@ -171,6 +172,6 @@ class LicenseFilesController extends Controller
}
}
return redirect()->route('license.index')->with('error', trans('admin/licenses/message.does_not_exist', ['id' => $fileId]));
return redirect()->route('licenses.index')->with('error', trans('admin/licenses/message.does_not_exist', ['id' => $fileId]));
}
}

8
app/Policies/LicensePolicy.php
View file

@ -42,8 +42,12 @@ class LicensePolicy extends CheckoutablePermissionsPolicy
* @param \App\Models\User $user
* @return mixed
*/
public function files(User $user)
public function files(User $user, $license = null)
{
return $user->hasAccess($this->columnName().'.files');
if ($user->hasAccess('licenses.files')) {
return true;
}
return false;
}
}

5
app/Policies/SnipePermissionsPolicy.php
View file

@ -61,6 +61,11 @@ abstract class SnipePermissionsPolicy
return $user->hasAccess($this->columnName().'.view');
}
public function files(User $user, $item = null)
{
return $user->hasAccess($this->columnName().'.files');
}
/**
* Determine whether the user can create accessories.
*

7
app/Providers/AuthServiceProvider.php
View file

@ -122,6 +122,13 @@ class AuthServiceProvider extends ServiceProvider
});
Gate::define('licenses.files', function ($user) {
if ($user->hasAccess('licenses.files')) {
return true;
}
});
// -----------------------------------------
// Reports
// -----------------------------------------

2
resources/lang/en/admin/licenses/message.php
View file

@ -2,7 +2,7 @@
return array(
'does_not_exist' => 'License does not exist.',
'does_not_exist' => 'License does not exist or you do not have permission to view it.',
'user_does_not_exist' => 'User does not exist.',
'asset_does_not_exist' => 'The asset you are trying to associate with this license does not exist.',
'owner_doesnt_match_asset' => 'The asset you are trying to associate with this license is owned by somene other than the person selected in the assigned to dropdown.',

4
resources/views/licenses/view.blade.php
View file

@ -37,6 +37,7 @@
</a>
</li>
@can('licenses.files', $license)
<li>
<a href="#files" data-toggle="tab">
<span class="hidden-lg hidden-md">
@ -46,6 +47,7 @@
</span>
</a>
</li>
@endcan
<li>
<a href="#history" data-toggle="tab">
@ -416,7 +418,7 @@
</div> <!--/.row-->
</div> <!-- /.tab-pane -->
@can('files', $license)
@can('licenses.files', $license)
<div class="tab-pane" id="files">
<div class="table-responsive">
<table