Skip to content

Commit 7b1c18d

Browse files
donkerdonker
committed
Security stuff
1 parent aa2525f commit 7b1c18d

8 files changed

Lines changed: 116 additions & 50 deletions

File tree

‎Server/LanguagePackManager/Common/ContextSecurity.cs‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ public class ContextSecurity
1313
public bool CanView { get; set; }
1414
public bool CanEdit { get; set; }
1515
public bool IsAdmin { get; set; }
16+
public bool IsTranslator { get; set; }
1617
private UserInfo user { get; set; }
1718
public int UserId
1819
{
@@ -41,19 +42,20 @@ public ContextSecurity(ModuleInfo objModule, UserInfo user)
4142
this.user = user;
4243
if (user.IsSuperUser)
4344
{
44-
CanView = CanEdit = IsAdmin = true;
45+
CanView = CanEdit = IsAdmin = IsTranslator = true;
4546
}
4647
else
4748
{
4849
IsAdmin = PortalSecurity.IsInRole(PortalSettings.Current.AdministratorRoleName);
4950
if (IsAdmin)
5051
{
51-
CanView = CanEdit = true;
52+
CanView = CanEdit = IsTranslator = true;
5253
}
5354
else
5455
{
5556
CanView = ModulePermissionController.CanViewModule(objModule);
5657
CanEdit = ModulePermissionController.HasModulePermission(objModule.ModulePermissions, "EDIT");
58+
IsTranslator = ModulePermissionController.HasModulePermission(objModule.ModulePermissions, "TRANSLATOR");
5759
}
5860
}
5961
}

‎Server/LanguagePackManager/Common/LpmAuthorizeAttribute.cs‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
using DotNetNuke.Common;
2+
using DotNetNuke.Entities.Users;
3+
using DotNetNuke.Instrumentation;
4+
using DotNetNuke.Web.Api;
5+
6+
namespace Connect.LanguagePackManager.Presentation.Common
7+
{
8+
public enum SecurityAccessLevel
9+
{
10+
Anonymous = 0,
11+
Authenticated = 1,
12+
View = 2,
13+
Edit = 3,
14+
Admin = 4,
15+
Host = 5,
16+
Translator = 6
17+
}
18+
19+
public class LpmAuthorizeAttribute : AuthorizeAttributeBase, IOverrideDefaultAuthLevel
20+
{
21+
private static readonly ILog Logger = LoggerSource.Instance.GetLogger(typeof(LpmAuthorizeAttribute));
22+
public SecurityAccessLevel SecurityLevel { get; set; }
23+
public UserInfo User { get; set; }
24+
public bool AllowApiKeyAccess { get; set; } = false;
25+
26+
public LpmAuthorizeAttribute()
27+
{
28+
SecurityLevel = SecurityAccessLevel.Admin;
29+
}
30+
31+
public LpmAuthorizeAttribute(SecurityAccessLevel accessLevel)
32+
{
33+
SecurityLevel = accessLevel;
34+
}
35+
36+
public override bool IsAuthorized(AuthFilterContext context)
37+
{
38+
Logger.Trace("IsAuthorized");
39+
if (SecurityLevel == SecurityAccessLevel.Anonymous)
40+
{
41+
Logger.Trace("Anonymous");
42+
return true;
43+
}
44+
User = HttpContextSource.Current.Request.IsAuthenticated ? UserController.Instance.GetCurrentUserInfo() : new UserInfo();
45+
Logger.Trace("UserId " + User.UserID.ToString());
46+
ContextSecurity security = new ContextSecurity(context.ActionContext.Request.FindModuleInfo(), User);
47+
Logger.Trace(security.ToString());
48+
switch (SecurityLevel)
49+
{
50+
case SecurityAccessLevel.Authenticated:
51+
return User.UserID != -1;
52+
case SecurityAccessLevel.Host:
53+
return User.IsSuperUser;
54+
case SecurityAccessLevel.Admin:
55+
return security.IsAdmin;
56+
case SecurityAccessLevel.Edit:
57+
return security.CanEdit;
58+
case SecurityAccessLevel.View:
59+
return security.CanView;
60+
case SecurityAccessLevel.Translator:
61+
return security.IsTranslator;
62+
}
63+
return false;
64+
}
65+
}
66+
}

‎Server/LanguagePackManager/Controllers/HomeController.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ namespace Connect.LanguagePackManager.Presentation.Controllers
66
public class HomeController : LanguagePackManagerMvcController
77
{
88
[HttpGet]
9+
[LpmAuthorize(SecurityLevel = SecurityAccessLevel.View)]
910
public ActionResult Index()
1011
{
1112
return View();

‎Server/LanguagePackManager/Controllers/LinksController.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,21 +9,24 @@ namespace Connect.LanguagePackManager.Presentation.Controllers
99
public class LinksController : LanguagePackManagerMvcController
1010
{
1111
[HttpGet]
12+
[LpmAuthorize(SecurityLevel = SecurityAccessLevel.Edit)]
1213
public ActionResult Index()
1314
{
1415
return View();
1516
}
1617

1718
[HttpGet]
19+
[LpmAuthorize(SecurityLevel = SecurityAccessLevel.Edit)]
1820
public ActionResult Edit(int linkId)
1921
{
2022
var link = PackageLinkRepository.Instance.GetPackageLink(ModuleContext.ModuleId, linkId);
21-
if (link == null) link = new Core.Models.PackageLinks.PackageLink();
23+
if (link == null) link = new PackageLink();
2224
return View(link);
2325
}
2426

2527
[HttpPost]
2628
[ValidateAntiForgeryToken]
29+
[LpmAuthorize(SecurityLevel = SecurityAccessLevel.Edit)]
2730
public ActionResult Edit(int linkId, PackageLink link)
2831
{
2932
link.Name = link.Name.Trim();

‎Server/LanguagePackManager/Controllers/PacksController.cs‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,15 @@ namespace Connect.LanguagePackManager.Presentation.Controllers
1313
public class PacksController : LanguagePackManagerMvcController
1414
{
1515
[HttpGet]
16-
public ActionResult Index(string locale)
17-
{
18-
return View();
19-
}
20-
21-
[HttpGet]
16+
[LpmAuthorize(SecurityLevel = SecurityAccessLevel.Translator)]
2217
public ActionResult Upload()
2318
{
2419
return View();
2520
}
2621

2722
[HttpPost]
2823
[ValidateAntiForgeryToken]
24+
[LpmAuthorize(SecurityLevel = SecurityAccessLevel.Translator)]
2925
public ActionResult Upload(object data)
3026
{
3127
var generic = this.Request.Form["GenericLanguage"].OnOffToBool();

‎Server/LanguagePackManager/Controllers/SettingsController.cs‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
1-
using DotNetNuke.Security;
21
using DotNetNuke.Web.Mvc.Framework.ActionFilters;
32
using Connect.LanguagePackManager.Presentation.Common;
43
using System.Web.Mvc;
54
using Connect.LanguagePackManager.Core.Common;
65

76
namespace Connect.LanguagePackManager.Presentation.Controllers
87
{
9-
[DnnModuleAuthorize(AccessLevel = SecurityAccessLevel.Edit)]
8+
[LpmAuthorize(SecurityLevel = SecurityAccessLevel.View)]
109
[DnnHandleError]
1110
public class SettingsController : LanguagePackManagerMvcController
1211
{

‎Server/LanguagePackManager/Views/Home/Index.cshtml‎

Lines changed: 38 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,45 @@
11
@inherits LanguagePackManagerWebPage
2-
@using Connect.LanguagePackManager.Presentation.Common
2+
@using Connect.LanguagePackManager.Core.Common;
3+
@using Connect.LanguagePackManager.Core.Repositories;
4+
@using Connect.LanguagePackManager.Presentation.Common;
5+
@using System.Linq;
36
@{
7+
LanguagePackManagerModuleContext.AddModuleScript();
8+
var knownGenericLocales = LocaleRepository.Instance.GetLocales().Where(l => l.Code.Length == 2).Select(l => l.Code).ToList();
9+
var locales = System.Globalization.CultureInfo.GetCultures(System.Globalization.CultureTypes.SpecificCultures)
10+
.Where(l => knownGenericLocales.Contains(l.TwoLetterISOLanguageName))
11+
.Select(l => new { Key = l.Name, Value = l.ParseRegion() });
12+
var genlocales = System.Globalization.CultureInfo.GetCultures(System.Globalization.CultureTypes.NeutralCultures)
13+
.Where(l => knownGenericLocales.Contains(l.TwoLetterISOLanguageName))
14+
.Select(l => new { Key = l.Name, Value = l.EnglishName });
15+
var packageList = PackageVersionRepository.Instance.GetPackageVersions(Dnn.ModuleContext.ModuleId)
16+
.Where(p => p.ContainedInPackageVersionId == null)
17+
.Select(p => new { Key = p.PackageId, Value = p.FriendlyName })
18+
.Distinct()
19+
.OrderBy(p => p.Value);
420
}
521

6-
<h1>LanguagePack Manager</h1>
22+
<h1>@Dnn.LocalizeString("LanguagePacks")</h1>
23+
24+
<div class="connectlpm packs"
25+
data-locale="@System.Threading.Thread.CurrentThread.CurrentCulture.TwoLetterISOLanguageName"
26+
data-moduleid="@Dnn.ActiveModule.ModuleID"
27+
data-tabid="@Dnn.ActiveModule.TabID"
28+
data-portalid="@Dnn.PortalSettings.PortalId"
29+
data-resources="@SerializedResources()"
30+
data-security="@(Newtonsoft.Json.JsonConvert.SerializeObject(LanguagePackManagerModuleContext.Security))"
31+
data-genlocales="@(Newtonsoft.Json.JsonConvert.SerializeObject(genlocales))"
32+
data-locales="@(Newtonsoft.Json.JsonConvert.SerializeObject(locales))"
33+
data-packages="@(Newtonsoft.Json.JsonConvert.SerializeObject(packageList))">
34+
</div>
735

836
<div>
9-
<a href="@Url.Action("Index", "Links")" class="dnnSecondaryAction">@Dnn.LocalizeString("Links")</a>
10-
<a href="@Url.Action("Upload", "Packs")" class="dnnSecondaryAction">@Dnn.LocalizeString("Upload")</a>
11-
<a href="@Url.Action("Index", "Packs")" class="dnnSecondaryAction">@Dnn.LocalizeString("Packs")</a>
37+
@if (LanguagePackManagerModuleContext.Security.CanEdit)
38+
{
39+
<a href="@Url.Action("Index", "Links")" class="dnnSecondaryAction">@Dnn.LocalizeString("Links")</a>
40+
}
41+
@if (LanguagePackManagerModuleContext.Security.IsTranslator)
42+
{
43+
<a href="@Url.Action("Upload", "Packs")" class="dnnSecondaryAction">@Dnn.LocalizeString("Upload")</a>
44+
}
1245
</div>

‎Server/LanguagePackManager/Views/Packs/Index.cshtml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

0 commit comments

Comments
 (0)