From 33c3c5ecc55d6718d13962b9ed0388534fb6b8be Mon Sep 17 00:00:00 2001
From: Maidul Islam <maidul98@gmail.com>
Date: Wed, 17 Jan 2024 15:33:55 -0500
Subject: [PATCH] add permission check for target env/path for imports

---
 .../src/services/secret-import/secret-import-service.ts   | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/backend-pg/src/services/secret-import/secret-import-service.ts b/backend-pg/src/services/secret-import/secret-import-service.ts
index 75de3f54b..9021fc744 100644
--- a/backend-pg/src/services/secret-import/secret-import-service.ts
+++ b/backend-pg/src/services/secret-import/secret-import-service.ts
@@ -48,11 +48,19 @@ export const secretImportServiceFactory = ({
     path
   }: TCreateSecretImportDTO) => {
     const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    
+    // check if user has permission to import into destination  path
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
+    // check if user has permission to import from target path
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment: data.environment, secretPath: data.path })
+    );
+
     const folder = await folderDal.findBySecretPath(projectId, environment, path);
     if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Create import" });