From 269985927e14f4429960d2a7bd42f30c7d64489e Mon Sep 17 00:00:00 2001
From: magicfelix <felix@felix-zauberer.de>
Date: Sat, 17 Dec 2022 14:00:26 +0100
Subject: [PATCH] Validate permissions in Queries
---
aleksis/core/schema/__init__.py | 28 +++++++++++++++++---------
aleksis/core/schema/base.py | 14 +++++++++++++
aleksis/core/schema/celery_progress.py | 8 ++++++--
aleksis/core/schema/group.py | 9 ++++++---
aleksis/core/schema/notification.py | 8 ++++++--
aleksis/core/schema/person.py | 8 ++++++--
6 files changed, 57 insertions(+), 18 deletions(-)
create mode 100644 aleksis/core/schema/base.py
diff --git a/aleksis/core/schema/__init__.py b/aleksis/core/schema/__init__.py
index 1f5a2fa8e..69a3bbf82 100644
--- a/aleksis/core/schema/__init__.py
+++ b/aleksis/core/schema/__init__.py
@@ -8,7 +8,11 @@ from haystack.utils.loading import UnifiedIndex
from ..models import Notification, Person, TaskUserAssignment
from ..util.apps import AppConfig
from ..util.core_helpers import get_allowed_object_ids, get_app_module, get_app_packages, has_person
-from .celery_progress import CeleryProgressFetchedMutation, CeleryProgressType
+from .celery_progress import (
+ CeleryProgressFetchedMutation,
+ CeleryProgressMetaType,
+ CeleryProgressType,
+)
from .group import GroupType # noqa
from .installed_apps import AppType
from .notification import MarkNotificationReadMutation, NotificationType
@@ -37,15 +41,18 @@ class Query(graphene.ObjectType):
)
def resolve_notifications(root, info, **kwargs):
- # FIXME do permission stuff
- return Notification.objects.all()
+ return NotificationType.get_queryset(
+ Notification.objects.all().order_by("-created"),
+ info,
+ )
def resolve_persons(root, info, **kwargs):
- # FIXME do permission stuff
- return Person.objects.all()
+ return PersonType.get_queryset(Person.objects.all(), info).all()
def resolve_person_by_id(root, info, id): # noqa
- return Person.objects.get(pk=id)
+ return PersonType.get_queryset(
+ Person.objects.filter(pk=id), info, "core.view_person_rule"
+ ).first()
def resolve_who_am_i(root, info, **kwargs):
if has_person(info.context.user):
@@ -60,10 +67,13 @@ class Query(graphene.ObjectType):
return [app for app in apps.get_app_configs() if isinstance(app, AppConfig)]
def resolve_celery_progress_by_task_id(root, info, task_id, **kwargs):
- task = TaskUserAssignment.objects.get(task_result__task_id=task_id)
+ task = CeleryProgressMetaType.get_queryset(
+ TaskUserAssignment.objects.filter(task_result__task_id=task_id),
+ info,
+ ).first()
- if not info.context.user.has_perm("core.view_progress_rule", task):
- return None
+ if not task:
+ raise PermissionDenied()
progress = task.get_progress_with_meta()
return progress
diff --git a/aleksis/core/schema/base.py b/aleksis/core/schema/base.py
new file mode 100644
index 000000000..363c6b8ac
--- /dev/null
+++ b/aleksis/core/schema/base.py
@@ -0,0 +1,14 @@
+from graphene_django import DjangoObjectType
+
+from ..util.core_helpers import queryset_rules_filter
+
+
+class RulesObjectType(DjangoObjectType):
+ class Meta:
+ abstract = True
+
+ @classmethod
+ def get_queryset(cls, queryset, info, perm):
+ q = super().get_queryset(queryset, info)
+
+ return queryset_rules_filter(info.context, q, perm)
diff --git a/aleksis/core/schema/celery_progress.py b/aleksis/core/schema/celery_progress.py
index 941d18f1d..c6fe93dd0 100644
--- a/aleksis/core/schema/celery_progress.py
+++ b/aleksis/core/schema/celery_progress.py
@@ -2,9 +2,9 @@ from django.contrib.messages.constants import DEFAULT_TAGS
import graphene
from graphene import ObjectType
-from graphene_django import DjangoObjectType
from ..models import TaskUserAssignment
+from .base import RulesObjectType
class CeleryProgressMessage(ObjectType):
@@ -28,7 +28,7 @@ class CeleryProgressAdditionalButtonType(ObjectType):
icon = graphene.String()
-class CeleryProgressMetaType(DjangoObjectType):
+class CeleryProgressMetaType(RulesObjectType):
additional_button = graphene.Field(CeleryProgressAdditionalButtonType, required=False)
task_id = graphene.String(required=True)
@@ -47,6 +47,10 @@ class CeleryProgressMetaType(DjangoObjectType):
"additional_button",
)
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_progress_rule"):
+ return super().get_queryset(queryset, info, perm)
+
def resolve_additional_button(root, info, **kwargs):
if not root.additional_button_title or not root.additional_button_url:
return None
diff --git a/aleksis/core/schema/group.py b/aleksis/core/schema/group.py
index 327daff3d..70f00bd1d 100644
--- a/aleksis/core/schema/group.py
+++ b/aleksis/core/schema/group.py
@@ -1,8 +1,11 @@
-from graphene_django import DjangoObjectType
-
from ..models import Group
+from .base import RulesObjectType
-class GroupType(DjangoObjectType):
+class GroupType(RulesObjectType):
class Meta:
model = Group
+
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_groups_rule"):
+ return super().get_queryset(queryset, info, perm)
diff --git a/aleksis/core/schema/notification.py b/aleksis/core/schema/notification.py
index 114f92b32..105ed1366 100644
--- a/aleksis/core/schema/notification.py
+++ b/aleksis/core/schema/notification.py
@@ -1,13 +1,17 @@
import graphene
-from graphene_django import DjangoObjectType
from ..models import Notification
+from .base import RulesObjectType
-class NotificationType(DjangoObjectType):
+class NotificationType(RulesObjectType):
class Meta:
model = Notification
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_notifications_rule"):
+ return super().get_queryset(queryset, info, perm)
+
class MarkNotificationReadMutation(graphene.Mutation):
class Arguments:
diff --git a/aleksis/core/schema/person.py b/aleksis/core/schema/person.py
index a48447273..c7b4fd6ff 100644
--- a/aleksis/core/schema/person.py
+++ b/aleksis/core/schema/person.py
@@ -1,14 +1,14 @@
from django.utils import timezone
import graphene
-from graphene_django import DjangoObjectType
from graphene_django.forms.mutation import DjangoModelFormMutation
from ..forms import PersonForm
from ..models import Person
+from .base import RulesObjectType
-class PersonType(DjangoObjectType):
+class PersonType(RulesObjectType):
class Meta:
model = Person
@@ -21,6 +21,10 @@ class PersonType(DjangoObjectType):
def resolve_notifications(root: Person, info, **kwargs):
return root.notifications.filter(send_at__lte=timezone.now()).order_by("read", "-created")
+ @classmethod
+ def get_queryset(cls, queryset, info, perm="core.view_persons_rule"):
+ return super().get_queryset(queryset, info, perm)
+
class PersonMutation(DjangoModelFormMutation):
person = graphene.Field(PersonType)
--
GitLab