kocoded/oqtane.framework
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #4982 from sbwalker/dev

Browse Source 
improve filtering logic in UserRole API
This commit is contained in:
Shaun Walker 2025-01-13 14:42:36 -05:00 committed by GitHub
commit aa5ea61638
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 30 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
Oqtane.Server/Controllers/UserRoleController.cs
View File

@ -120,6 +120,13 @@ namespace Oqtane.Controllers
} }
private UserRole Filter(UserRole userrole, int userid) private UserRole Filter(UserRole userrole, int userid)
{
// include all properties if authorized
if (_userPermissions.IsAuthorized(User, userrole.User.SiteId, EntityNames.UserRole, -1, PermissionNames.Write, RoleNames.Admin))
{
return userrole;
}
else
{ {
// clone object to avoid mutating cache // clone object to avoid mutating cache
UserRole filtered = null; UserRole filtered = null;
@ -128,7 +135,7 @@ namespace Oqtane.Controllers
{ {
filtered = new UserRole(); filtered = new UserRole();
// public properties // include public properties
filtered.UserRoleId = userrole.UserRoleId; filtered.UserRoleId = userrole.UserRoleId;
filtered.UserId = userrole.UserId; filtered.UserId = userrole.UserId;
filtered.RoleId = userrole.RoleId; filtered.RoleId = userrole.RoleId;
@ -143,20 +150,11 @@ namespace Oqtane.Controllers
filtered.Role.SiteId = userrole.Role.SiteId; filtered.Role.SiteId = userrole.Role.SiteId;
filtered.Role.RoleId = userrole.Role.RoleId; filtered.Role.RoleId = userrole.Role.RoleId;
filtered.Role.Name = userrole.Role.Name; filtered.Role.Name = userrole.Role.Name;
// include private properties if administrator
if (_userPermissions.IsAuthorized(User, filtered.User.SiteId, EntityNames.UserRole, -1, PermissionNames.Write, RoleNames.Admin))
{
filtered.User.Email = userrole.User.Email;
filtered.User.PhotoFileId = userrole.User.PhotoFileId;
filtered.User.LastLoginOn = userrole.User.LastLoginOn;
filtered.User.LastIPAddress = userrole.User.LastIPAddress;
filtered.User.CreatedOn = userrole.User.CreatedOn;
}
} }
return filtered; return filtered;
} }
}
// POST api/<controller> // POST api/<controller>
[HttpPost] [HttpPost]