Browse Source

Improved get list with hidden items permission check.

pull/49/head
gdlcf88 6 years ago
parent
commit
f08cc005dc
  1. 6
      modules/EasyAbp.EShop.Products/src/EasyAbp.EShop.Products.Application/EasyAbp/EShop/Products/Categories/CategoryAppService.cs
  2. 4
      modules/EasyAbp.EShop.Products/src/EasyAbp.EShop.Products.Application/EasyAbp/EShop/Products/Products/ProductAppService.cs

6
modules/EasyAbp.EShop.Products/src/EasyAbp.EShop.Products.Application/EasyAbp/EShop/Products/Categories/CategoryAppService.cs

@ -35,9 +35,9 @@ namespace EasyAbp.EShop.Products.Categories
public override async Task<PagedResultDto<CategoryDto>> GetListAsync(GetCategoryListDto input) public override async Task<PagedResultDto<CategoryDto>> GetListAsync(GetCategoryListDto input)
{ {
// Todo: Check if current user is an admin of the store. // Todo: Check if current user is an admin of the store.
var isCurrentUserStoreAdmin = true; var isCurrentUserStoreAdmin = true && await AuthorizationService.IsGrantedAsync(ProductsPermissions.Categories.Default);
if (input.ShowHidden && (!isCurrentUserStoreAdmin || !await AuthorizationService.IsGrantedAsync(ProductsPermissions.Categories.Default))) if (input.ShowHidden && !isCurrentUserStoreAdmin)
{ {
throw new NotAllowedToGetCategoryListWithShowHiddenException(); throw new NotAllowedToGetCategoryListWithShowHiddenException();
} }

4
modules/EasyAbp.EShop.Products/src/EasyAbp.EShop.Products.Application/EasyAbp/EShop/Products/Products/ProductAppService.cs

@ -194,9 +194,9 @@ namespace EasyAbp.EShop.Products.Products
await CheckGetListPolicyAsync(); await CheckGetListPolicyAsync();
// Todo: Check if current user is an admin of the store. // Todo: Check if current user is an admin of the store.
var isCurrentUserStoreAdmin = true; var isCurrentUserStoreAdmin = true && await AuthorizationService.IsGrantedAsync(ProductsPermissions.Products.Default);
if (input.ShowHidden && (!isCurrentUserStoreAdmin || !await AuthorizationService.IsGrantedAsync(ProductsPermissions.Products.Default))) if (input.ShowHidden && !isCurrentUserStoreAdmin)
{ {
throw new NotAllowedToGetProductListWithShowHiddenException(); throw new NotAllowedToGetProductListWithShowHiddenException();
} }

Loading…
Cancel
Save