yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ensure the user is authenticated to see webprofiler/miniprofiler logs (#16007)

Browse Source
This commit is contained in:
Bjarke Berg
2024-04-08 11:14:25 +02:00
committed by GitHub
parent b552ccb885
commit 85d35b3a69
2 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/Umbraco.Web.Common/Profiler/ConfigureMiniProfilerOptions.cs
View File

@@ -1,5 +1,8 @@
using System.Security.Claims;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Options;
using OpenIddict.Abstractions;
using StackExchange.Profiling;
using Umbraco.Cms.Core.Configuration.Models;
using Umbraco.Cms.Core.Hosting;
@@ -35,9 +38,17 @@ internal sealed class ConfigureMiniProfilerOptions : IConfigureOptions<MiniProfi
options.IgnoredPaths.Add(WebPath.Combine(options.RouteBasePath, "results-index"));
options.IgnoredPaths.Add(WebPath.Combine(options.RouteBasePath, "results"));
options.ResultsAuthorize = IsBackofficeUserAuthorized;
options.ResultsListAuthorize = IsBackofficeUserAuthorized;
options.ResultsAuthorizeAsync = IsBackofficeUserAuthorized;
options.ResultsListAuthorizeAsync = IsBackofficeUserAuthorized;
}
private bool IsBackofficeUserAuthorized(HttpRequest request) => true;// FIXME when we can get current backoffice user, _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser is not null;
private async Task<bool> IsBackofficeUserAuthorized(HttpRequest request)
{
AuthenticateResult authenticateResult = await request.HttpContext.AuthenticateBackOfficeAsync();
ClaimsIdentity? identity = authenticateResult.Principal?.GetUmbracoIdentity();
return identity?.GetClaims(Core.Constants.Security.AllowedApplicationsClaimType)
.InvariantContains(Core.Constants.Applications.Settings) ?? false;
}
}

2
src/Umbraco.Web.Common/Repositories/WebProfilerRepository.cs
View File

@@ -21,7 +21,7 @@ internal class WebProfilerRepository : IWebProfilerRepository
{
if (status)
{
_httpContextAccessor.GetRequiredHttpContext().Response.Cookies.Append(CookieName, string.Empty, new CookieOptions { Expires = DateTime.Now.AddYears(1) });
_httpContextAccessor.GetRequiredHttpContext().Response.Cookies.Append(CookieName, "1", new CookieOptions { Expires = DateTime.Now.AddYears(1) });
}
else
{