DC/dc-project
1
1
Fork 0
Code Issues 25 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

improve security.

Browse Source
This commit is contained in:
Fabrice Lecomte
2019-08-30 22:32:30 +02:00
parent f5bff403f0
commit 9e88b33595
14 changed files with 109 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/main/kotlin/fr/dcproject/security/voter/ConstitutionVoter.kt
View File

@@ -1,5 +1,6 @@
package fr.dcproject.security.voter
import fr.dcproject.entity.Comment
import fr.dcproject.entity.User
import io.ktor.application.ApplicationCall
import fr.dcproject.entity.Constitution as ConstitutionEntity
@@ -14,7 +15,9 @@ class ConstitutionVoter: Voter {
}
override fun supports(action: ActionI, call: ApplicationCall, subject: Any?): Boolean {
return (action is Action || action is CommentVoter.Action) && subject is ConstitutionEntity?
return (action is Action || action is CommentVoter.Action || action is VoteVoter.Action)
&&
(subject is List<*> || subject is ConstitutionEntity? || subject is VoteEntity<*> || subject is Comment<*>)
}
override fun vote(action: ActionI, call: ApplicationCall, subject: Any?): Vote {
@@ -24,7 +27,19 @@ class ConstitutionVoter: Voter {
}
if (action == Action.VIEW) {
return Vote.GRANTED
if (subject is ConstitutionEntity) {
return if (subject.isDeleted()) Vote.DENIED
else Vote.GRANTED
}
if (subject is List<*>) {
subject.forEach {
if (it !is ConstitutionEntity || it.isDeleted()) {
return Vote.DENIED
}
}
return Vote.GRANTED
}
return Vote.DENIED
}
if (action == Action.DELETE && user is User && subject is ConstitutionEntity && subject.createdBy?.userId == user.id) {