nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 21:18:13 -05:00
Code

inital thoughts on how to determine if the user has actual can manage permissions on a cipher they are trying to delete

Browse Source
This commit is contained in:
cd-bitwarden 2025-02-18 21:05:53 -05:00
parent f27886e312
commit 7cccb5f0bc
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Api/Vault/Controllers/CiphersController.cs
View File

@ -709,7 +709,12 @@ public class CiphersController : Controller
{
var userId = _userService.GetProperUserId(User).Value;
var cipher = await GetByIdAsync(id, userId);
if (cipher == null)
var collectionCiphers = await _collectionCipherRepository.GetManyByUserIdCipherIdAsync(userId, cipher.Id);
var hasManagePermissionsForCipher = (await _collectionRepository.GetManyByUserIdAsync(userId))
.Where(c => c.OrganizationId == cipher.OrganizationId && c.Manage && collectionCiphers.Select(cc => cc.CollectionId).Contains(c.Id))
.ToDictionary(c => c.Id)?.Count > 0;
if (cipher == null || (!hasManagePermissionsForCipher && cipher.Type == Core.Vault.Enums.CipherType.SecureNote))
{
throw new NotFoundException();
}