yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adhered to linting rules for authorization policy handlers, requirements and tests.

Browse Source
This commit is contained in:
Andy Butland
2020-12-06 09:13:29 +01:00
parent 05dc597fc2
commit 61cbb84dd3
37 changed files with 697 additions and 461 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
src/Umbraco.Web.BackOffice/Authorization/MediaPermissionsQueryStringHandler.cs
View File

@@ -1,29 +1,41 @@
using System.Threading.Tasks;
// Copyright (c) Umbraco.
// See LICENSE for more details.
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Primitives;
using Umbraco.Core.Models;
using Umbraco.Core.Security;
using Umbraco.Core.Services;
namespace Umbraco.Web.BackOffice.Authorization
{
/// <summary>
/// Used to authorize if the user has the correct permission access to the media for the media id specified in a query string.
/// </summary>
public class MediaPermissionsQueryStringHandler : PermissionsQueryStringHandler<MediaPermissionsQueryStringRequirement>
{
private readonly MediaPermissions _mediaPermissions;
/// <summary>
/// Initializes a new instance of the <see cref="MediaPermissionsQueryStringHandler"/> class.
/// </summary>
/// <param name="backOfficeSecurityAccessor">Accessor for back-office security.</param>
/// <param name="httpContextAccessor">Accessor for the HTTP context of the current request.</param>
/// <param name="entityService">Service for entity operations.</param>
/// <param name="mediaPermissions">Helper for media authorization checks.</param>
public MediaPermissionsQueryStringHandler(
IBackOfficeSecurityAccessor backofficeSecurityAccessor,
IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
IHttpContextAccessor httpContextAccessor,
IEntityService entityService,
MediaPermissions mediaPermissions)
: base(backofficeSecurityAccessor, httpContextAccessor, entityService)
{
_mediaPermissions = mediaPermissions;
}
: base(backOfficeSecurityAccessor, httpContextAccessor, entityService) => _mediaPermissions = mediaPermissions;
/// <inheritdoc/>
protected override Task<bool> IsAuthorized(AuthorizationHandlerContext context, MediaPermissionsQueryStringRequirement requirement)
{
if (!HttpContextAccessor.HttpContext.Request.Query.TryGetValue(requirement.QueryStringName, out var routeVal))
if (!HttpContextAccessor.HttpContext.Request.Query.TryGetValue(requirement.QueryStringName, out StringValues routeVal))
{
// Must succeed this requirement since we cannot process it.
return Task.FromResult(true);
@@ -37,10 +49,10 @@ namespace Umbraco.Web.BackOffice.Authorization
return Task.FromResult(true);
}
var permissionResult = _mediaPermissions.CheckPermissions(
BackofficeSecurityAccessor.BackOfficeSecurity.CurrentUser,
MediaPermissions.MediaAccess permissionResult = _mediaPermissions.CheckPermissions(
BackOfficeSecurityAccessor.BackOfficeSecurity.CurrentUser,
nodeId,
out var mediaItem);
out IMedia mediaItem);
if (mediaItem != null)
{
@@ -53,6 +65,6 @@ namespace Umbraco.Web.BackOffice.Authorization
MediaPermissions.MediaAccess.Denied => Task.FromResult(false),
_ => Task.FromResult(true),
};
}
}
}
}