-
Notifications
You must be signed in to change notification settings - Fork 13
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
security : protect access to the resource editor
Add guard for any resources to disallow access to the editor based on user permissions API. Add a basic error page management * Without this fix, user can access to a resources editor but cannot apply any changes (backend return 403 - forbidden). * With this fix, user without required privileges cannot access to the resource editor. * Closes rero/rero-ils#575 Co-Authored-by: Renaud Michotte <renaud.michotte@gmail.com>
- Loading branch information
Showing
17 changed files
with
180 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
70 changes: 70 additions & 0 deletions
70
projects/admin/src/app/error/error-page/error-page.component.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| import { ActivatedRoute } from '@angular/router'; | ||
| import { Component, OnInit } from '@angular/core'; | ||
| import { map } from 'rxjs/operators'; | ||
| import { marker } from '@biesbjerg/ngx-translate-extract-marker'; | ||
|
|
||
| export function _(str) { | ||
| return marker(str); | ||
| } | ||
|
|
||
| @Component({ | ||
| selector: 'admin-error-page', | ||
| template: ` | ||
| <div class="alert alert-{{ messages[statusCode].level || 'danger' }}"> | ||
| <h1 class="alert-heading mb-4">{{ statusCode }} - {{ messages[statusCode].title }}</h1> | ||
| <pre *ngFor="let text of messages[statusCode].description || []">{{ text }}</pre> | ||
| <hr> | ||
| <p>For any information please contact system administrator</p> | ||
| </div> | ||
| ` | ||
| }) | ||
|
|
||
| export class ErrorPageComponent implements OnInit { | ||
|
|
||
| /** the status code to display. By default 404 : Page not found */ | ||
| statusCode = 404; | ||
| /** All messages ablt to be managed by this component. Availables for each error are : | ||
| * - title : the error title | ||
| * - description : A human readable description of this error as Array<string>. Each array | ||
| * element will be a separate line. | ||
| * - level: the boostrap alert look-and-feel level to use for the error. 'danger' by default. | ||
| */ | ||
| messages = { | ||
| 401: { | ||
| title: _('Unauthorized'), | ||
| description: [_('Access denied due to invalid credentials.')], | ||
| level: 'warning' | ||
| }, | ||
| 403: { | ||
| title: _('Forbidden access'), | ||
| description: [_('You don\'t have permission to access this page.')], | ||
| level: 'warning' | ||
| }, | ||
| 404: { | ||
| title: _('Page not found'), | ||
| description: [_('Woops. Looks like this page doesn\'t exists')] | ||
| }, | ||
| 418: { | ||
| title: _('I\'m a teapot'), | ||
| description: [ | ||
| _('The requested entity body is short and stout'), | ||
| _('Tip me over and pour me out') | ||
| ], | ||
| level: 'success' | ||
| }, | ||
| 500: { | ||
| title: _('Internal server error'), | ||
| desctiption: [_('Oops, Something went wrong !')] | ||
| } | ||
| }; | ||
|
|
||
| constructor(private _route: ActivatedRoute) { } | ||
|
|
||
| ngOnInit() { | ||
| this._route.params.pipe( | ||
| map(params => params.status_code || 404), // check for status_code parameter from ActivatedRoute | ||
| map(code => /^\d+$/.test(code) ? parseInt(code, 10) : 404), // try to parse status code to integer | ||
| map(code => code in this.messages ? code : 404) // check if http code definition exists | ||
| ).subscribe(code => this.statusCode = code ); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| import { | ||
| CanActivate, | ||
| ActivatedRouteSnapshot, | ||
| Router, | ||
| RouterStateSnapshot, | ||
| UrlTree, | ||
| NavigationError | ||
| } from '@angular/router'; | ||
| import { Injectable } from '@angular/core'; | ||
| import {Observable, throwError} from 'rxjs'; | ||
| import { RecordPermission, RecordPermissionService } from '../service/record-permission.service'; | ||
| import { ToastrService } from 'ngx-toastr'; | ||
| import { TranslateService } from '@ngx-translate/core'; | ||
|
|
||
|
|
||
| @Injectable({ | ||
| providedIn: 'root' | ||
| }) | ||
| export class CanUpdateGuard implements CanActivate { | ||
|
|
||
| constructor( | ||
| private _permissionService: RecordPermissionService, | ||
| private _toastrService: ToastrService, | ||
| private _translateService: TranslateService, | ||
| private _router: Router) { | ||
| } | ||
|
|
||
| /** | ||
| * Check if the current logged user can update a resource | ||
| * @param next - ActivatedRouteSnapshot | ||
| * @param state - RouterStateSnapshot | ||
| */ | ||
| canActivate(next: ActivatedRouteSnapshot, | ||
| state: RouterStateSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree { | ||
|
|
||
| this._permissionService.getPermission(next.params.type, next.params.pid).subscribe( | ||
| (permission: RecordPermission) => { | ||
| if (!permission.update.can) { | ||
| this._router.navigate(['/errors/403']); | ||
| } | ||
| } | ||
| ); | ||
| return true; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.