Fossil SCM
Added permissions checks to artifact/file and artifact/wiki. Renamed a mysterious mlink property.
Commit
83ba8852a7996043dac7e1b1eec0a1d68e72d51e
Parent
a4f4c62a1a7334a…
1 file changed
+13
-1
+13
-1
| --- src/json_artifact.c | ||
| +++ src/json_artifact.c | ||
| @@ -212,11 +212,17 @@ | ||
| 212 | 212 | /* Final entry MUST have a NULL name. */ |
| 213 | 213 | {NULL,NULL} |
| 214 | 214 | }; |
| 215 | 215 | |
| 216 | 216 | cson_value * json_artifact_wiki(int rid){ |
| 217 | + if( ! g.perm.RdWiki ){ | |
| 218 | + json_set_err(FSL_JSON_E_DENIED, | |
| 219 | + "Requires 'j' privileges."); | |
| 220 | + return NULL; | |
| 221 | + }else{ | |
| 217 | 222 | return json_get_wiki_page_by_rid(rid, 0); |
| 223 | + } | |
| 218 | 224 | } |
| 219 | 225 | |
| 220 | 226 | cson_value * json_artifact_file(int rid){ |
| 221 | 227 | cson_value * payV = NULL; |
| 222 | 228 | cson_object * pay = NULL; |
| @@ -223,10 +229,16 @@ | ||
| 223 | 229 | const char *zMime; |
| 224 | 230 | const char *zRaw; |
| 225 | 231 | Blob content; |
| 226 | 232 | Stmt q; |
| 227 | 233 | |
| 234 | + if( ! g.perm.Read ){ | |
| 235 | + json_set_err(FSL_JSON_E_DENIED, | |
| 236 | + "Requires 'o' privileges."); | |
| 237 | + return NULL; | |
| 238 | + } | |
| 239 | + | |
| 228 | 240 | payV = cson_value_new_object(); |
| 229 | 241 | pay = cson_value_get_object(payV); |
| 230 | 242 | |
| 231 | 243 | content_get(rid, &content); |
| 232 | 244 | zMime = mimetype_from_content(&content); |
| @@ -254,11 +266,11 @@ | ||
| 254 | 266 | db_prepare(&q, |
| 255 | 267 | "SELECT filename.name AS name, " |
| 256 | 268 | " cast(strftime('%%s',event.mtime) as int) AS mtime," |
| 257 | 269 | " coalesce(event.ecomment,event.comment) as comment," |
| 258 | 270 | " coalesce(event.euser,event.user) as user," |
| 259 | - " b.uuid as uuid, mlink.mperm as wtf1," | |
| 271 | + " b.uuid as uuid, mlink.mperm as mperm,"/* WTF is mperm?*/ | |
| 260 | 272 | " coalesce((SELECT value FROM tagxref" |
| 261 | 273 | " WHERE tagid=%d AND tagtype>0 AND rid=mlink.mid),'trunk') as branch" |
| 262 | 274 | " FROM mlink, filename, event, blob a, blob b" |
| 263 | 275 | " WHERE filename.fnid=mlink.fnid" |
| 264 | 276 | " AND event.objid=mlink.mid" |
| 265 | 277 |
| --- src/json_artifact.c | |
| +++ src/json_artifact.c | |
| @@ -212,11 +212,17 @@ | |
| 212 | /* Final entry MUST have a NULL name. */ |
| 213 | {NULL,NULL} |
| 214 | }; |
| 215 | |
| 216 | cson_value * json_artifact_wiki(int rid){ |
| 217 | return json_get_wiki_page_by_rid(rid, 0); |
| 218 | } |
| 219 | |
| 220 | cson_value * json_artifact_file(int rid){ |
| 221 | cson_value * payV = NULL; |
| 222 | cson_object * pay = NULL; |
| @@ -223,10 +229,16 @@ | |
| 223 | const char *zMime; |
| 224 | const char *zRaw; |
| 225 | Blob content; |
| 226 | Stmt q; |
| 227 | |
| 228 | payV = cson_value_new_object(); |
| 229 | pay = cson_value_get_object(payV); |
| 230 | |
| 231 | content_get(rid, &content); |
| 232 | zMime = mimetype_from_content(&content); |
| @@ -254,11 +266,11 @@ | |
| 254 | db_prepare(&q, |
| 255 | "SELECT filename.name AS name, " |
| 256 | " cast(strftime('%%s',event.mtime) as int) AS mtime," |
| 257 | " coalesce(event.ecomment,event.comment) as comment," |
| 258 | " coalesce(event.euser,event.user) as user," |
| 259 | " b.uuid as uuid, mlink.mperm as wtf1," |
| 260 | " coalesce((SELECT value FROM tagxref" |
| 261 | " WHERE tagid=%d AND tagtype>0 AND rid=mlink.mid),'trunk') as branch" |
| 262 | " FROM mlink, filename, event, blob a, blob b" |
| 263 | " WHERE filename.fnid=mlink.fnid" |
| 264 | " AND event.objid=mlink.mid" |
| 265 |
| --- src/json_artifact.c | |
| +++ src/json_artifact.c | |
| @@ -212,11 +212,17 @@ | |
| 212 | /* Final entry MUST have a NULL name. */ |
| 213 | {NULL,NULL} |
| 214 | }; |
| 215 | |
| 216 | cson_value * json_artifact_wiki(int rid){ |
| 217 | if( ! g.perm.RdWiki ){ |
| 218 | json_set_err(FSL_JSON_E_DENIED, |
| 219 | "Requires 'j' privileges."); |
| 220 | return NULL; |
| 221 | }else{ |
| 222 | return json_get_wiki_page_by_rid(rid, 0); |
| 223 | } |
| 224 | } |
| 225 | |
| 226 | cson_value * json_artifact_file(int rid){ |
| 227 | cson_value * payV = NULL; |
| 228 | cson_object * pay = NULL; |
| @@ -223,10 +229,16 @@ | |
| 229 | const char *zMime; |
| 230 | const char *zRaw; |
| 231 | Blob content; |
| 232 | Stmt q; |
| 233 | |
| 234 | if( ! g.perm.Read ){ |
| 235 | json_set_err(FSL_JSON_E_DENIED, |
| 236 | "Requires 'o' privileges."); |
| 237 | return NULL; |
| 238 | } |
| 239 | |
| 240 | payV = cson_value_new_object(); |
| 241 | pay = cson_value_get_object(payV); |
| 242 | |
| 243 | content_get(rid, &content); |
| 244 | zMime = mimetype_from_content(&content); |
| @@ -254,11 +266,11 @@ | |
| 266 | db_prepare(&q, |
| 267 | "SELECT filename.name AS name, " |
| 268 | " cast(strftime('%%s',event.mtime) as int) AS mtime," |
| 269 | " coalesce(event.ecomment,event.comment) as comment," |
| 270 | " coalesce(event.euser,event.user) as user," |
| 271 | " b.uuid as uuid, mlink.mperm as mperm,"/* WTF is mperm?*/ |
| 272 | " coalesce((SELECT value FROM tagxref" |
| 273 | " WHERE tagid=%d AND tagtype>0 AND rid=mlink.mid),'trunk') as branch" |
| 274 | " FROM mlink, filename, event, blob a, blob b" |
| 275 | " WHERE filename.fnid=mlink.fnid" |
| 276 | " AND event.objid=mlink.mid" |
| 277 |