fix: check rules on http resource handlers
@@ -91,7 +91,7 @@ func resourceDeleteHandler(fileCache FileCache) handleFunc {
func resourcePostHandler(fileCache FileCache) handleFunc {
return withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
- if !d.user.Perm.Create {
+ if !d.user.Perm.Create || !d.Check(r.URL.Path) {
return http.StatusForbidden, nil
}
@@ -141,7 +141,7 @@ func resourcePostHandler(fileCache FileCache) handleFunc {
}
var resourcePutHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
- if !d.user.Perm.Modify {
+ if !d.user.Perm.Modify || !d.Check(r.URL.Path) {
return http.StatusForbidden, nil
}
@@ -174,6 +174,9 @@ var resourcePatchHandler = withUser(func(w http.ResponseWriter, r *http.Request,
dst := r.URL.Query().Get("destination")
action := r.URL.Query().Get("action")
dst, err := url.QueryUnescape(dst)
+ if !d.Check(src) || !d.Check(dst) {
+ return http.StatusForbidden, nil
+ }
if err != nil {
return errToStatus(err), err
}
