nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-01 08:02:49 -05:00
Code Activity

[AC-1666] Removed EditAnyCollection from Create/Delete permission checks (#3301)

Browse Source 
* fix: remove EditAnyCollection from Create/Delete permission check, refs AC-1666

* fix: updated comment, refs AC-1666
This commit is contained in:
Vincent Salucci
2023-09-28 20:32:52 -05:00
committed by GitHub
parent dd1061493c
commit fbb7aa1350
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/Api/Vault/AuthorizationHandlers/Collections/CollectionAuthorizationHandler.cs
View File

@ -77,10 +77,10 @@ public class CollectionAuthorizationHandler : BulkAuthorizationHandler<Collectio
return; return;
} }
// Owners, Admins, Providers, and users with CreateNewCollections or EditAnyCollection permission can always create collections // Owners, Admins, Providers, and users with CreateNewCollections permission can always create collections
if ( if (
org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin || org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin ||
org.Permissions.CreateNewCollections || org.Permissions.EditAnyCollection || org.Permissions is { CreateNewCollections: true } ||
await _currentContext.ProviderUserForOrgAsync(org.Id)) await _currentContext.ProviderUserForOrgAsync(org.Id))
{ {
context.Succeed(requirement); context.Succeed(requirement);
@ -93,10 +93,10 @@ public class CollectionAuthorizationHandler : BulkAuthorizationHandler<Collectio
private async Task CanDeleteAsync(AuthorizationHandlerContext context, CollectionOperationRequirement requirement, private async Task CanDeleteAsync(AuthorizationHandlerContext context, CollectionOperationRequirement requirement,
ICollection<Collection> resources, CurrentContextOrganization org) ICollection<Collection> resources, CurrentContextOrganization org)
{ {
// Owners, Admins, Providers, and users with DeleteAnyCollection or EditAnyCollection permission can always delete collections // Owners, Admins, Providers, and users with DeleteAnyCollection permission can always delete collections
if ( if (
org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin || org.Type is OrganizationUserType.Owner or OrganizationUserType.Admin ||
org.Permissions.DeleteAnyCollection || org.Permissions.EditAnyCollection || org.Permissions is { DeleteAnyCollection: true } ||
await _currentContext.ProviderUserForOrgAsync(org.Id)) await _currentContext.ProviderUserForOrgAsync(org.Id))
{ {
context.Succeed(requirement); context.Succeed(requirement);