rzmk/learnhouse
1
0
Fork 0
mirror of https://github.com/rzmk/learnhouse.git synced 2025-12-19 04:19:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: trail security issue

Browse source
This commit is contained in:
swve 2023-07-10 15:14:02 +01:00
parent 056365dac9
commit ef3d8c1f06
4 changed files with 22 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/routers/trail.py
View file

@ -1,6 +1,6 @@
from fastapi import APIRouter, Depends, Request
from src.security.auth import get_current_user
from src.services.trail import Trail, add_activity_to_trail, add_course_to_trail, create_trail, get_user_trail_with_orgslug, get_user_trail, remove_course_from_trail
from src.services.trail.trail import Trail, add_activity_to_trail, add_course_to_trail, create_trail, get_user_trail_with_orgslug, get_user_trail, remove_course_from_trail
router = APIRouter()

0
src/services/trail/__init__.py Normal file
View file

20
src/services/trail.py → src/services/trail/trail.py
View file

@ -172,6 +172,12 @@ async def add_activity_to_trail(
{"user_id": user.user_id, "courses.course_id": courseid, "org_id": org_id}
)
if user.user_id == "anonymous":
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Anonymous users cannot add activity to trail",
)
if not trail:
return Trail(masked=False, courses=[])
@ -201,7 +207,13 @@ async def add_course_to_trail(
) -> Trail:
trails = request.app.db["trails"]
orgs = request.app.db["organizations"]
if user.user_id == "anonymous":
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Anonymous users cannot add activity to trail",
)
org = await orgs.find_one({"slug": orgslug})
org = PublicOrganization(**org)
@ -247,6 +259,12 @@ async def remove_course_from_trail(
trails = request.app.db["trails"]
orgs = request.app.db["organizations"]
if user.user_id == "anonymous":
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Anonymous users cannot add activity to trail",
)
org = await orgs.find_one({"slug": orgslug})
org = PublicOrganization(**org)