add API method to get File based on name, and fix permission validation for Folder

This commit is contained in:
sbwalker
2023-07-10 08:44:14 -04:00
parent 9a3b458c45
commit c597c4c234
4 changed files with 34 additions and 3 deletions

View File

@ -129,6 +129,22 @@ namespace Oqtane.Controllers
}
}
[HttpGet("name/{name}/{folderId}")]
public Models.File Get(string name, int folderId)
{
Models.File file = _files.GetFile(folderId, name);
if (file != null && file.Folder.SiteId == _alias.SiteId && _userPermissions.IsAuthorized(User, PermissionNames.View, file.Folder.PermissionList))
{
return file;
}
else
{
_logger.Log(LogLevel.Error, this, LogFunction.Security, "Unauthorized File Get Attempt {Name} For Folder {FolderId}", name, folderId);
HttpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden;
return null;
}
}
// PUT api/<controller>/5
[HttpPut("{id}")]
[Authorize(Roles = RoleNames.Registered)]