nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 13:08:17 -05:00
Code

using the new CanDelete function

Browse Source
This commit is contained in:
cd-bitwarden 2025-03-18 16:36:39 -04:00
parent 2702a8a66a
commit 6858aa31d7
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/Api/Vault/Controllers/CiphersController.cs
View File

@ -16,6 +16,7 @@ using Bit.Core.Services;
using Bit.Core.Settings; using Bit.Core.Settings;
using Bit.Core.Tools.Services; using Bit.Core.Tools.Services;
using Bit.Core.Utilities; using Bit.Core.Utilities;
using Bit.Core.Vault.Authorization.Permissions;
using Bit.Core.Vault.Entities; using Bit.Core.Vault.Entities;
using Bit.Core.Vault.Models.Data; using Bit.Core.Vault.Models.Data;
using Bit.Core.Vault.Queries; using Bit.Core.Vault.Queries;
@ -708,13 +709,11 @@ public class CiphersController : Controller
public async Task Delete(Guid id) public async Task Delete(Guid id)
{ {
var userId = _userService.GetProperUserId(User).Value; var userId = _userService.GetProperUserId(User).Value;
var user = await _userService.GetUserByIdAsync(userId);
var cipher = await GetByIdAsync(id, userId); var cipher = await GetByIdAsync(id, userId);
var collectionCiphers = await _collectionCipherRepository.GetManyByUserIdCipherIdAsync(userId, cipher.Id); var canDelete = NormalCipherPermissions.CanDelete(user, cipher, null);
var hasManagePermissionsForCipher = (await _collectionRepository.GetManyByUserIdAsync(userId))
.Where(c => c.OrganizationId == cipher.OrganizationId && c.Manage && collectionCiphers.Select(cc => cc.CollectionId).Contains(c.Id))
.ToDictionary(c => c.Id)?.Count > 0;
if (cipher == null || (!hasManagePermissionsForCipher && cipher.Type == Core.Vault.Enums.CipherType.SecureNote)) if (cipher == null || !canDelete)
{ {
throw new NotFoundException(); throw new NotFoundException();
} }