nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 13:08:17 -05:00
Code

updating both delete methods to check permissions

Browse Source
This commit is contained in:
cd-bitwarden 2025-03-19 14:57:50 -04:00
parent 53936e1809
commit 1d8a0accf3
1 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/Api/Vault/Controllers/CiphersController.cs
View File

@ -710,8 +710,18 @@ public class CiphersController : Controller
{ {
var userId = _userService.GetProperUserId(User).Value; var userId = _userService.GetProperUserId(User).Value;
var cipher = await GetByIdAsync(id, userId); var cipher = await GetByIdAsync(id, userId);
var user = await _userService.GetUserByIdAsync(userId);
if (cipher == null) OrganizationAbility orgAbility = null;
if (cipher.OrganizationId.HasValue)
{
orgAbility = await _applicationCacheService.GetOrganizationAbilityAsync((Guid)cipher.OrganizationId);
}
var canDelete = NormalCipherPermissions.CanDelete(user, cipher, orgAbility);
if (cipher == null || !canDelete)
{ {
throw new NotFoundException(); throw new NotFoundException();
} }
@ -781,7 +791,14 @@ public class CiphersController : Controller
var userId = _userService.GetProperUserId(User).Value; var userId = _userService.GetProperUserId(User).Value;
var cipher = await GetByIdAsync(id, userId); var cipher = await GetByIdAsync(id, userId);
var user = await _userService.GetUserByIdAsync(userId); var user = await _userService.GetUserByIdAsync(userId);
var orgAbility = await _applicationCacheService.GetOrganizationAbilityAsync(cipher.OrganizationId.Value); //Clean thi sup later
OrganizationAbility orgAbility = null;
if (cipher.OrganizationId.HasValue)
{
orgAbility = await _applicationCacheService.GetOrganizationAbilityAsync((Guid)cipher.OrganizationId);
}
var canDelete = NormalCipherPermissions.CanDelete(user, cipher, orgAbility); var canDelete = NormalCipherPermissions.CanDelete(user, cipher, orgAbility);
if (cipher == null || !canDelete) if (cipher == null || !canDelete)