From e932fa5404f81fab812c4177d8a07b836d1a1380 Mon Sep 17 00:00:00 2001 From: Andy Butland Date: Mon, 28 Apr 2025 14:10:43 +0200 Subject: [PATCH] Webhook log authorization and file system path checks (#19177) * Add authorization for webhooks to item and log endpoints. * Remove full path details from exception when requesting a path outside of the physical file system's root. * Added missing usings. * Revert changes to the webhook items API --------- Co-authored-by: kjac --- .../Controllers/Webhook/Logs/WebhookLogControllerBase.cs | 3 +++ src/Umbraco.Core/IO/PhysicalFileSystem.cs | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/Umbraco.Cms.Api.Management/Controllers/Webhook/Logs/WebhookLogControllerBase.cs b/src/Umbraco.Cms.Api.Management/Controllers/Webhook/Logs/WebhookLogControllerBase.cs index 6581335165..020aa6ef24 100644 --- a/src/Umbraco.Cms.Api.Management/Controllers/Webhook/Logs/WebhookLogControllerBase.cs +++ b/src/Umbraco.Cms.Api.Management/Controllers/Webhook/Logs/WebhookLogControllerBase.cs @@ -1,3 +1,4 @@ +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; using Umbraco.Cms.Api.Common.ViewModels.Pagination; using Umbraco.Cms.Api.Management.Factories; @@ -5,11 +6,13 @@ using Umbraco.Cms.Api.Management.Routing; using Umbraco.Cms.Api.Management.ViewModels.Webhook.Logs; using Umbraco.Cms.Core; using Umbraco.Cms.Core.Models; +using Umbraco.Cms.Web.Common.Authorization; namespace Umbraco.Cms.Api.Management.Controllers.Webhook.Logs; [VersionedApiBackOfficeRoute($"{Constants.UdiEntityType.Webhook}")] [ApiExplorerSettings(GroupName = "Webhook")] +[Authorize(Policy = AuthorizationPolicies.TreeAccessWebhooks)] public class WebhookLogControllerBase : ManagementApiControllerBase { protected PagedViewModel CreatePagedWebhookLogResponseModel(PagedModel logs, IWebhookPresentationFactory webhookPresentationFactory) diff --git a/src/Umbraco.Core/IO/PhysicalFileSystem.cs b/src/Umbraco.Core/IO/PhysicalFileSystem.cs index f2ddb74f0b..32f0d0fdab 100644 --- a/src/Umbraco.Core/IO/PhysicalFileSystem.cs +++ b/src/Umbraco.Core/IO/PhysicalFileSystem.cs @@ -358,7 +358,7 @@ namespace Umbraco.Cms.Core.IO // nothing prevents us to reach the file, security-wise, yet it is outside // this filesystem's root - throw - throw new UnauthorizedAccessException($"File original: [{originalPath}] full: [{path}] is outside this filesystem's root."); + throw new UnauthorizedAccessException($"Requested path {originalPath} is outside this filesystem's root."); } ///