public/mailtrain
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Enforce manageChannels global permission in channels model

Browse source
This commit is contained in:
joker-x 2020-08-29 23:36:40 +02:00
parent e0edcda3dd
commit 16665536c0
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
server/models/channels.js
View file

@ -30,6 +30,7 @@ function hash(entity) {
} }
async function listDTAjax(context, params) { async function listDTAjax(context, params) {
shares.enforceGlobalPermission(context, 'manageChannels');
return await dtHelpers.ajaxListWithPermissions( return await dtHelpers.ajaxListWithPermissions(
context, context,
[{ entityTypeId: 'channel', requiredOperations: ['view'] }], [{ entityTypeId: 'channel', requiredOperations: ['view'] }],
@ -44,6 +45,7 @@ async function listDTAjax(context, params) {
} }
async function listWithCreateCampaignPermissionDTAjax(context, params) { async function listWithCreateCampaignPermissionDTAjax(context, params) {
shares.enforceGlobalPermission(context, 'manageChannels');
return await dtHelpers.ajaxListWithPermissions( return await dtHelpers.ajaxListWithPermissions(
context, context,
[{ entityTypeId: 'channel', requiredOperations: ['createCampaign'] }], [{ entityTypeId: 'channel', requiredOperations: ['createCampaign'] }],
@ -95,6 +97,7 @@ async function _getByTx(tx, context, key, id, withPermissions = true) {
} }
async function getByIdTx(tx, context, id, withPermissions = true) { async function getByIdTx(tx, context, id, withPermissions = true) {
shares.enforceGlobalPermission(context, 'manageChannels');
await shares.enforceEntityPermissionTx(tx, context, 'channel', id, 'view'); await shares.enforceEntityPermissionTx(tx, context, 'channel', id, 'view');
return await _getByTx(tx, context, 'id', id, withPermissions); return await _getByTx(tx, context, 'id', id, withPermissions);
@ -140,6 +143,7 @@ async function _validateAndPreprocess(tx, context, entity, isCreate) {
} }
async function _createTx(tx, context, entity, content) { async function _createTx(tx, context, entity, content) {
shares.enforceGlobalPermission(context, 'manageChannels');
return await knex.transaction(async tx => { return await knex.transaction(async tx => {
await shares.enforceEntityPermissionTx(tx, context, 'namespace', entity.namespace, 'createCampaign'); await shares.enforceEntityPermissionTx(tx, context, 'namespace', entity.namespace, 'createCampaign');
@ -169,6 +173,7 @@ async function create(context, entity) {
} }
async function updateWithConsistencyCheck(context, entity) { async function updateWithConsistencyCheck(context, entity) {
shares.enforceGlobalPermission(context, 'manageChannels');
await knex.transaction(async tx => { await knex.transaction(async tx => {
await shares.enforceEntityPermissionTx(tx, context, 'channel', entity.id, 'edit'); await shares.enforceEntityPermissionTx(tx, context, 'channel', entity.id, 'edit');
@ -198,6 +203,7 @@ async function updateWithConsistencyCheck(context, entity) {
async function remove(context, id) { async function remove(context, id) {
shares.enforceGlobalPermission(context, 'manageChannels');
await knex.transaction(async tx => { await knex.transaction(async tx => {
await shares.enforceEntityPermissionTx(tx, context, 'channel', id, 'delete'); await shares.enforceEntityPermissionTx(tx, context, 'channel', id, 'delete');