Mirrors/unleash.unleash
1
0
Fork 0
mirror of https://github.com/Unleash/unleash.git synced 2025-10-27 11:02:16 +01:00
Code Issues Projects Releases Wiki Activity

Don't expose user permissions when extendedPermissions is disabled, cleanup controller.js

Browse Source
This commit is contained in:
Benjamin Ludewig 2018-12-19 13:35:54 +01:00 committed by Ivar Conradi Østhus
parent d9804c0114
commit 29257c2228
3 changed files with 37 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/routes/admin-api/index.js
View File

@ -25,7 +25,7 @@ class AdminApi extends Controller {
); );
this.app.use('/events', new EventController(stores).router); this.app.use('/events', new EventController(stores).router);
this.app.use('/metrics', new MetricsController(perms, stores).router); this.app.use('/metrics', new MetricsController(perms, stores).router);
this.app.use('/user', new UserController().router); this.app.use('/user', new UserController(perms).router);
} }
index(req, res) { index(req, res) {

10
lib/routes/admin-api/user.js
View File

@ -3,17 +3,21 @@
const Controller = require('../controller'); const Controller = require('../controller');
class UserController extends Controller { class UserController extends Controller {
constructor() { constructor(perms) {
super(); super(perms);
this.get('/', this.getUser); this.get('/', this.getUser);
this.get('/logout', this.logout); this.get('/logout', this.logout);
} }
getUser(req, res) { getUser(req, res) {
if (req.user) { if (req.user) {
const user = Object.assign({}, req.user);
if (!this.extendedPermissions) {
delete user.permissions;
}
return res return res
.status(200) .status(200)
.json(req.user) .json(user)
.end(); .end();
} else { } else {
return res.status(404).end(); return res.status(404).end();

63
lib/routes/controller.js
View File

@ -6,54 +6,49 @@ const { requirePermission } = require('./../permissions');
* Base class for Controllers to standardize binding to express Router. * Base class for Controllers to standardize binding to express Router.
*/ */
class Controller { class Controller {
constructor(extendedPerms) { constructor(extendedPermissions) {
const router = Router(); const router = Router();
this.app = router; this.app = router;
this.extendedPerms = extendedPerms; this.extendedPermissions = extendedPermissions;
}
checkPermission(permission) {
if (this.extendedPermissions && permission) {
return requirePermission(permission);
}
return (res, req, next) => next();
} }
get(path, handler, permission) { get(path, handler, permission) {
if (this.extendedPerms && permission) { this.app.get(
this.app.get( path,
path, this.checkPermission(permission),
requirePermission(permission), handler.bind(this)
handler.bind(this) );
);
}
this.app.get(path, handler.bind(this));
} }
post(path, handler, permission) { post(path, handler, permission) {
if (this.extendedPerms && permission) { this.app.post(
this.app.post( path,
path, this.checkPermission(permission),
requirePermission(permission), handler.bind(this)
handler.bind(this) );
);
}
this.app.post(path, handler.bind(this));
} }
put(path, handler, permission) { put(path, handler, permission) {
if (this.extendedPerms && permission) { this.app.put(
this.app.put( path,
path, this.checkPermission(permission),
requirePermission(permission), handler.bind(this)
handler.bind(this) );
);
}
this.app.put(path, handler.bind(this));
} }
delete(path, handler, permission) { delete(path, handler, permission) {
if (this.extendedPerms && permission) { this.app.delete(
this.app.delete( path,
path, this.checkPermission(permission),
requirePermission(permission), handler.bind(this)
handler.bind(this) );
);
}
this.app.delete(path, handler.bind(this));
} }
use(path, router) { use(path, router) {