awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 04:27:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

add permission check for target env/path for imports

Browse Source
This commit is contained in:
Maidul Islam
2024-01-27 12:38:23 +05:30
committed by Akhil Mohan
parent 627c8711dc
commit 33c3c5ecc5
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend-pg/src/services/secret-import/secret-import-service.ts
+8
View File
@@ -48,11 +48,19 @@ export const secretImportServiceFactory = ({
path path
}: TCreateSecretImportDTO) => { }: TCreateSecretImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId); const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
// check if user has permission to import into destination path
ForbiddenError.from(permission).throwUnlessCan( ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create, ProjectPermissionActions.Create,
subject(ProjectPermissionSub.Secrets, { environment, secretPath: path }) subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
); );
// check if user has permission to import from target path
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
subject(ProjectPermissionSub.Secrets, { environment: data.environment, secretPath: data.path })
);
const folder = await folderDal.findBySecretPath(projectId, environment, path); const folder = await folderDal.findBySecretPath(projectId, environment, path);
if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Create import" }); if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Create import" });