80 lines
3.2 KiB
C#
80 lines
3.2 KiB
C#
using System.Threading.Tasks;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Oqtane.Enums;
|
|
using Oqtane.Extensions;
|
|
using Oqtane.Infrastructure;
|
|
using Oqtane.Shared;
|
|
|
|
namespace Oqtane.Security
|
|
{
|
|
public class PermissionHandler : AuthorizationHandler<PermissionRequirement>
|
|
{
|
|
private readonly IHttpContextAccessor _accessor;
|
|
private readonly IUserPermissions _userPermissions;
|
|
private readonly ILogManager _logger;
|
|
|
|
public PermissionHandler(IHttpContextAccessor accessor, IUserPermissions userPermissions, ILogManager logger)
|
|
{
|
|
_accessor = accessor;
|
|
_userPermissions = userPermissions;
|
|
_logger = logger;
|
|
}
|
|
|
|
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)
|
|
{
|
|
// permission is scoped based on entity name and in some cases entity id
|
|
var ctx = _accessor.HttpContext;
|
|
if (ctx != null)
|
|
{
|
|
int siteId = -1;
|
|
if (ctx.GetAlias() != null)
|
|
{
|
|
siteId = ctx.GetAlias().SiteId;
|
|
}
|
|
|
|
int entityId = -1;
|
|
|
|
// get entityid from querystring based on a parameter format of auth{entityname}id (ie. authmoduleid )
|
|
if (ctx.Request.Query.ContainsKey("auth" + requirement.EntityName.ToLower() + "id"))
|
|
{
|
|
if (!int.TryParse(ctx.Request.Query["auth" + requirement.EntityName.ToLower() + "id"], out entityId))
|
|
{
|
|
entityId = -1;
|
|
}
|
|
}
|
|
|
|
// legacy support for deprecated CreateAuthorizationPolicyUrl(string url, int entityId)
|
|
if (entityId == -1)
|
|
{
|
|
if (ctx.Request.Query.ContainsKey("entityid"))
|
|
{
|
|
if (!int.TryParse(ctx.Request.Query["entityid"], out entityId))
|
|
{
|
|
entityId = -1;
|
|
}
|
|
}
|
|
}
|
|
|
|
// validate permissions
|
|
if (_userPermissions.IsAuthorized(context.User, siteId, requirement.EntityName, entityId, requirement.PermissionName, requirement.Roles))
|
|
{
|
|
context.Succeed(requirement);
|
|
}
|
|
else
|
|
{
|
|
if (entityId == -1)
|
|
{
|
|
_logger.Log(LogLevel.Error, this, LogFunction.Security, "User {User} Does Not Have {PermissionName} Permission For {EntityName} Entity", context.User.Identity.Name, requirement.PermissionName, requirement.EntityName);
|
|
}
|
|
else
|
|
{
|
|
_logger.Log(LogLevel.Error, this, LogFunction.Security, "User {User} Does Not Have {PermissionName} Permission For {EntityName} Entity With ID {EntityId}", context.User.Identity.Name, requirement.PermissionName, requirement.EntityName, entityId);
|
|
}
|
|
}
|
|
}
|
|
return Task.CompletedTask;
|
|
}
|
|
}
|
|
}
|