llvy.ltd/casdoor
1
0
Fork 0
mirror of https://github.com/casdoor/casdoor.git synced 2025-05-24 08:20:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix delete-resource authz failure.

Browse Source
This commit is contained in:
Yang Luo 2022-03-01 22:37:23 +08:00
parent 697b3e4998
commit 18aa70dfb2
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
authz/authz.go
View File

@ -54,7 +54,7 @@ m = (r.subOwner == p.subOwner || p.subOwner == "*") && \
(r.urlPath == p.urlPath || p.urlPath == "*") && \ (r.urlPath == p.urlPath || p.urlPath == "*") && \
(r.objOwner == p.objOwner || p.objOwner == "*") && \ (r.objOwner == p.objOwner || p.objOwner == "*") && \
(r.objName == p.objName || p.objName == "*") || \ (r.objName == p.objName || p.objName == "*") || \
(r.urlPath == "/api/update-user" && r.subOwner == r.objOwner && r.subName == r.objName) (r.subOwner == r.objOwner && r.subName == r.objName)
` `
m, err := model.NewModelFromString(modelText) m, err := model.NewModelFromString(modelText)

11
routers/authz_filter.go
View File

@ -18,6 +18,7 @@ import (
"encoding/json" "encoding/json"
"fmt" "fmt"
"net/http" "net/http"
"strings"
"github.com/astaxie/beego/context" "github.com/astaxie/beego/context"
"github.com/casdoor/casdoor/authz" "github.com/casdoor/casdoor/authz"
@ -57,6 +58,8 @@ func getSubject(ctx *context.Context) (string, string) {
func getObject(ctx *context.Context) (string, string) { func getObject(ctx *context.Context) (string, string) {
method := ctx.Request.Method method := ctx.Request.Method
path := ctx.Request.URL.Path
if method == http.MethodGet { if method == http.MethodGet {
// query == "?id=built-in/admin" // query == "?id=built-in/admin"
id := ctx.Input.Query("id") id := ctx.Input.Query("id")
@ -78,6 +81,14 @@ func getObject(ctx *context.Context) (string, string) {
//panic(err) //panic(err)
return "", "" return "", ""
} }
if path == "/api/delete-resource" {
tokens := strings.Split(obj.Name, "/")
if len(tokens) >= 2 {
obj.Name = tokens[len(tokens)-2]
}
}
return obj.Owner, obj.Name return obj.Owner, obj.Name
} }
} }