This commit is contained in:
Bjarke Berg
2023-10-19 03:30:35 +02:00
parent 151fccee97
commit df4cd63962
3 changed files with 18 additions and 13 deletions

View File

@@ -2337,11 +2337,11 @@ public class ContentController : ContentControllerBase
return NotFound("There is no content node with id {model.NodeId}.");
}
EntityPermission? permission =
_userService.GetPermissions(_backofficeSecurityAccessor.BackOfficeSecurity?.CurrentUser, node.Path);
// Validate permissions on node
var permissions = _userService.GetAllPermissions(_backofficeSecurityAccessor.BackOfficeSecurity?.CurrentUser, node.Path);
if (permission?.AssignedPermissions.Contains(ActionAssignDomain.ActionLetter.ToString(), StringComparer.Ordinal) == false)
if (permissions.Any(x =>
x.AssignedPermissions.Contains(ActionAssignDomain.ActionLetter.ToString(), StringComparer.Ordinal) && x.EntityId == node.Id) == false)
{
HttpContext.SetReasonPhrase("Permission Denied.");
return BadRequest("You do not have permission to assign domains on that node.");