nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-01 08:02:49 -05:00
Code Activity

[AC-1163] Manage users permissions should allow collection assignment (#2808)

Browse Source 
* [AC-1163] Update ViewAllCollections method to include check for ManagerUsers permission

Users with ManagerUsers permission need to be able to view all collections in order to assign them to other users.

* [AC-1163] Revert change to CurrentContext

* [AC-1163] Add check for ManageUsers to list collections endpoint
This commit is contained in:
Shane Melton
2023-06-08 09:02:01 -07:00
committed by GitHub
parent 27e75e4459
commit cc4b6bb2fa
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Api/Controllers/CollectionsController.cs
View File

@ -87,7 +87,7 @@ public class CollectionsController : Controller
// We always need to know which collections the current user is assigned to // We always need to know which collections the current user is assigned to
var assignedOrgCollections = await _collectionRepository.GetManyByUserIdWithAccessAsync(_currentContext.UserId.Value, orgId); var assignedOrgCollections = await _collectionRepository.GetManyByUserIdWithAccessAsync(_currentContext.UserId.Value, orgId);
if (await _currentContext.ViewAllCollections(orgId)) if (await _currentContext.ViewAllCollections(orgId) || await _currentContext.ManageUsers(orgId))
{ {
// The user can view all collections, but they may not always be assigned to all of them // The user can view all collections, but they may not always be assigned to all of them
var allOrgCollections = await _collectionRepository.GetManyByOrganizationIdWithAccessAsync(orgId); var allOrgCollections = await _collectionRepository.GetManyByOrganizationIdWithAccessAsync(orgId);