yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V14: Tighten permissions for folder controllers (#15457)

Browse Source 
* Fixing folder controller policies

* Remove unused policy
This commit is contained in:
Elitsa Marinovska
2023-12-14 15:03:35 +01:00
committed by GitHub
parent b4ca478f2c
commit dbdf3cf03d
4 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Umbraco.Cms.Api.Management/Controllers/DataType/Folder/DataTypeFolderControllerBase.cs
View File

@@ -12,7 +12,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.DataType.Folder;
[ApiController]
[VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.DataType}/folder")]
[ApiExplorerSettings(GroupName = "Data Type")]
[Authorize(Policy = "New" + AuthorizationPolicies.TreeAccessDocumentsOrDocumentTypes)]
[Authorize(Policy = "New" + AuthorizationPolicies.TreeAccessDocumentTypes)]
public abstract class DataTypeFolderControllerBase : FolderManagementControllerBase<IDataType>
{
protected DataTypeFolderControllerBase(

2
src/Umbraco.Cms.Api.Management/Controllers/DocumentType/Folder/DocumentTypeFolderControllerBase.cs
View File

@@ -12,7 +12,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.DocumentType.Folder;
[ApiController]
[VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.DocumentType}/folder")]
[ApiExplorerSettings(GroupName = "Document Type")]
[Authorize(Policy = "New" + AuthorizationPolicies.TreeAccessDocumentsOrDocumentTypes)]
[Authorize(Policy = "New" + AuthorizationPolicies.TreeAccessDocumentTypes)]
public abstract class DocumentTypeFolderControllerBase : FolderManagementControllerBase<IContentType>
{
protected DocumentTypeFolderControllerBase(

2
src/Umbraco.Cms.Api.Management/Controllers/MediaType/Folder/MediaTypeFolderControllerBase.cs
View File

@@ -12,7 +12,7 @@ namespace Umbraco.Cms.Api.Management.Controllers.MediaType.Folder;
[ApiController]
[VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.MediaType}/folder")]
[ApiExplorerSettings(GroupName = "Media Type")]
[Authorize(Policy = "New" + AuthorizationPolicies.TreeAccessMediaOrMediaTypes)]
[Authorize(Policy = "New" + AuthorizationPolicies.TreeAccessMediaTypes)]
public abstract class MediaTypeFolderControllerBase : FolderManagementControllerBase<IMediaType>
{
protected MediaTypeFolderControllerBase(

1
src/Umbraco.Cms.Api.Management/DependencyInjection/BackOfficeAuthPolicyBuilderExtensions.cs
View File

@@ -86,7 +86,6 @@ internal static class BackOfficeAuthPolicyBuilderExtensions
AddPolicy(AuthorizationPolicies.TreeAccessDocumentTypes, Constants.Security.AllowedApplicationsClaimType, Constants.Applications.Settings);
AddPolicy(AuthorizationPolicies.TreeAccessLanguages, Constants.Security.AllowedApplicationsClaimType, Constants.Applications.Settings);
AddPolicy(AuthorizationPolicies.TreeAccessMediaTypes, Constants.Security.AllowedApplicationsClaimType, Constants.Applications.Settings);
AddPolicy(AuthorizationPolicies.TreeAccessMediaOrMediaTypes, Constants.Security.AllowedApplicationsClaimType, Constants.Applications.Media, Constants.Applications.Settings);
AddPolicy(AuthorizationPolicies.TreeAccessMemberGroups, Constants.Security.AllowedApplicationsClaimType, Constants.Applications.Members);
AddPolicy(AuthorizationPolicies.TreeAccessMemberTypes, Constants.Security.AllowedApplicationsClaimType, Constants.Applications.Settings);
AddPolicy(AuthorizationPolicies.TreeAccessPartialViews, Constants.Security.AllowedApplicationsClaimType, Constants.Applications.Settings);