mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2024-11-19 09:54:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Require Owner role to the store for modifying store via Greenfield

Browse Source
This commit is contained in:
nicolas.dorier 2020-06-12 18:26:20 +09:00
parent 1889c33d80
commit f40a8853f6
No known key found for this signature in database
GPG Key ID: 6618763EF09186FE
3 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
BTCPayServer.Client/Permissions.cs
View File

@ -49,6 +49,10 @@ namespace BTCPayServer.Client
{
return policy.StartsWith("btcpay.store", StringComparison.OrdinalIgnoreCase);
}
public static bool IsStoreModifyPolicy(string policy)
{
return policy.StartsWith("btcpay.store.canmodify", StringComparison.OrdinalIgnoreCase);
}
public static bool IsServerPolicy(string policy)
{

10
BTCPayServer.Tests/GreenfieldAPITests.cs
View File

@ -10,8 +10,10 @@ using BTCPayServer.Controllers;
using BTCPayServer.Events;
using BTCPayServer.JsonConverters;
using BTCPayServer.Services;
using BTCPayServer.Services.Stores;
using BTCPayServer.Tests.Logging;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using NBitcoin;
using NBitpayClient;
using Newtonsoft.Json;
@ -251,6 +253,14 @@ namespace BTCPayServer.Tests
var scopedClient =
await user.CreateClient(Permission.Create(Policies.CanViewStoreSettings, user.StoreId).ToString());
Assert.Single(await scopedClient.GetStores());
// We strip the user's Owner right, so the key should not work
using var ctx = tester.PayTester.GetService<Data.ApplicationDbContextFactory>().CreateContext();
var storeEntity = await ctx.UserStore.SingleAsync(u => u.ApplicationUserId == user.UserId && u.StoreDataId == newStore.Id);
storeEntity.Role = "Guest";
await ctx.SaveChangesAsync();
await AssertHttpError(403, async () => await client.UpdateStore(newStore.Id, new UpdateStoreRequest() { Name = "B" }));
}
}

5
BTCPayServer/Security/GreenField/GreenFieldAuthorizationHandler.cs
View File

@ -49,6 +49,11 @@ namespace BTCPayServer.Security.GreenField
var store = await _storeRepository.FindStore((string)storeId, userid);
if (store == null)
break;
if(Policies.IsStoreModifyPolicy(policy))
{
if (store.Role != StoreRoles.Owner)
break;
}
success = true;
_HttpContext.SetStoreData(store);
}