mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2025-02-21 22:11:48 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix app permissions (#3227)

Browse source 
* Fix app permissions

As pointed out by @nicolasdorier [here](https://github.com/btcpayserver/btcpayserver/pull/3205#issuecomment-999437555).

* Fix for login codes view

* Ensure app belongs to store
This commit is contained in:
d11n 2021-12-26 04:20:46 +01:00 • committed by GitHub
parent 48ac996d77
commit 4a66c91cac
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
BTCPayServer/Security/CookieAuthorizationHandler.cs
View file

@ -66,8 +66,15 @@ namespace BTCPayServer.Security
if (routeData.Values.TryGetValue("appId", out var vAppId)) if (routeData.Values.TryGetValue("appId", out var vAppId))
{ {
string appId = vAppId as string; string appId = vAppId as string;
app = await _appService.GetApp(appId, null); app = await _appService.GetAppDataIfOwner(userId, appId);
storeId ??= app?.StoreDataId; if (storeId == null)
{
storeId = app?.StoreDataId;
}
else if (app?.StoreDataId != storeId)
{
app = null;
}
} }
// resolve from payment request // resolve from payment request
if (routeData.Values.TryGetValue("payReqId", out var vPayReqId)) if (routeData.Values.TryGetValue("payReqId", out var vPayReqId))

2
BTCPayServer/Views/Manage/LoginCodes.cshtml
View file

@ -1,6 +1,6 @@
@model string @model string
@{ @{
ViewData.SetActivePageAndTitle(ManageNavPages.LoginCodes, "Login codes"); ViewData.SetActivePage(ManageNavPages.LoginCodes, "Login codes");
} }
<h2 class="mb-4">@ViewData["Title"]</h2> <h2 class="mb-4">@ViewData["Title"]</h2>
<p>Easily log into BTCPay Server on another device using a simple login code from an already authenticated device.</p> <p>Easily log into BTCPay Server on another device using a simple login code from an already authenticated device.</p>