From 22eef48fcfae5ca71d17d7f7074a8f0b1a40a7bd Mon Sep 17 00:00:00 2001
From: Quentin RIBAC <quentin.ribac@xelians.fr>
Date: Mon, 20 Dec 2021 10:49:38 +0100
Subject: [PATCH] FEAT #17436 TIME 0:20 better validation
---
src/app/group/controllers/GroupController.php | 11 +++++++++--
src/app/group/models/GroupPrivilegeModel.php | 1 +
src/app/user/controllers/UserController.php | 2 +-
3 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/src/app/group/controllers/GroupController.php b/src/app/group/controllers/GroupController.php
index 10089f949d..7a34c6c631 100755
--- a/src/app/group/controllers/GroupController.php
+++ b/src/app/group/controllers/GroupController.php
@@ -175,8 +175,15 @@ class GroupController
public function getGroupPrivilege(Request $request, Response $response, array $args)
{
- $hasGroup = UserGroupModel::hasGroup(['userId' => $GLOBALS['id'], 'groupId' => (int)$args['id']]);
- $hasRight = PrivilegeController::hasRightByPrivilege(['userId' => $GLOBALS['id'], 'groupId' => (int)$args['id'], 'privilegeId' => $args['privilegeId'], 'readOnly' => true]);
+ if (!Validator::intType()->validate($args['id'])) {
+ return $response->withStatus(400)->withJson(['errors' => 'Route id in not an integer']);
+ }
+ if (!Validator::stringType()->notEmpty()->validate($args['privilegeId'])) {
+ return $response->withStatus(400)->withJson(['errors' => 'Route privilegeId is empty or not a string']);
+ }
+
+ $hasGroup = UserGroupModel::hasGroup(['userId' => $GLOBALS['id'], 'groupId' => $args['id']]);
+ $hasRight = PrivilegeController::hasRightByPrivilege(['userId' => $GLOBALS['id'], 'groupId' => $args['id'], 'privilegeId' => $args['privilegeId'], 'readOnly' => true]);
if (!$hasGroup && !$hasRight) {
return $response->withStatus(403)->withJson(['errors' => 'Current user cannot see this privilege']);
}
diff --git a/src/app/group/models/GroupPrivilegeModel.php b/src/app/group/models/GroupPrivilegeModel.php
index e56ffe1c8e..b4f1576ca9 100755
--- a/src/app/group/models/GroupPrivilegeModel.php
+++ b/src/app/group/models/GroupPrivilegeModel.php
@@ -101,6 +101,7 @@ class GroupPrivilegeModel
ValidatorModel::notEmpty($args, ['groupId', 'privilegeId']);
ValidatorModel::intVal($args, ['groupId']);
ValidatorModel::stringType($args, ['privilegeId']);
+ ValidatorModel::arrayType($args, ['parameters']);
DatabaseModel::update([
'table' => 'groups_privileges',
diff --git a/src/app/user/controllers/UserController.php b/src/app/user/controllers/UserController.php
index a81dddb92a..0db1564fd9 100755
--- a/src/app/user/controllers/UserController.php
+++ b/src/app/user/controllers/UserController.php
@@ -788,7 +788,7 @@ class UserController
$manageableGroups = UserController::getManageableGroups(['userId' => $GLOBALS['id']]);
- return $response->withStatus(200)->withJson(['groups' => $manageableGroups]);
+ return $response->withJson(['groups' => $manageableGroups]);
}
public static function getUserInformationsById(array $args)
--
GitLab