mirror/opencloud
1
0
Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-07-29 00:38:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10092 from kobergj/FixActivitiesLeak

Browse Source 
Fix unauthorized activity get
This commit is contained in:
kobergj
2024-09-18 10:49:07 +02:00
committed by GitHub
parent bf9c0d9d6d bed59dd9fd
commit 6a2ae2553a
2 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
changelog/unreleased/fix-acitivity-leak.md Normal file
View File

@@ -0,0 +1,5 @@
Bugfix: Fix Activities leak
Fix activities endpoint by preventing unauthorized users to get activities
https://github.com/owncloud/ocis/pull/10092

12
services/activitylog/pkg/service/http.go
View File

@@ -53,6 +53,12 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
return
}
gwc, err := s.gws.Next()
if err != nil {
w.WriteHeader(http.StatusInternalServerError)
return
}
rid, limit, rawActivityAccepted, activityAccepted, sort, err := s.getFilters(r.URL.Query().Get("kql"))
if err != nil {
s.log.Info().Str("query", r.URL.Query().Get("kql")).Err(err).Msg("error getting filters")
@@ -61,6 +67,12 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
return
}
_, err = utils.GetResourceByID(ctx, rid, gwc)
if err != nil {
w.WriteHeader(http.StatusForbidden)
return
}
raw, err := s.Activities(rid)
if err != nil {
s.log.Error().Err(err).Msg("error getting activities")