Browse Source

Fix permission check.

pull/864/head
Sebastian 4 years ago
parent
commit
5d493a2ea6
  1. 19
      backend/src/Squidex.Domain.Apps.Core.Operations/Scripting/ScriptScope.cs
  2. 6
      backend/src/Squidex.Domain.Apps.Entities/Contents/DomainObject/ContentDomainObject.cs
  3. 4
      frontend/src/app/features/schemas/pages/schema/scripts/schema-scripts-form.component.ts
  4. 4
      frontend/src/app/features/settings/pages/asset-scripts/asset-scripts-page.component.ts

19
backend/src/Squidex.Domain.Apps.Core.Operations/Scripting/ScriptScope.cs

@ -10,14 +10,15 @@ namespace Squidex.Domain.Apps.Core.Scripting
[Flags] [Flags]
public enum ScriptScope public enum ScriptScope
{ {
Async, None = 0,
AssetScript, AssetScript = 1,
AssetTrigger, AssetTrigger = 2,
ContentScript, Async = 4,
ContentTrigger, CommentTrigger = 8,
Transform, ContentScript = 16,
SchemaTrigger, ContentTrigger = 32,
UsageTrigger, SchemaTrigger = 128,
CommentTrigger Transform = 256,
UsageTrigger = 512,
} }
} }

6
backend/src/Squidex.Domain.Apps.Entities/Contents/DomainObject/ContentDomainObject.cs

@ -250,7 +250,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
private async Task ChangeCore(ChangeContentStatus c, ContentOperation operation) private async Task ChangeCore(ChangeContentStatus c, ContentOperation operation)
{ {
operation.MustHavePermission(Permissions.AppContentsChangeStatusOwn); operation.MustHavePermission(Permissions.AppContentsChangeStatus);
operation.MustNotChangeSingleton(c.Status); operation.MustNotChangeSingleton(c.Status);
if (c.Status == Snapshot.EditingStatus()) if (c.Status == Snapshot.EditingStatus())
@ -383,7 +383,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
private async Task ValidateCore(ContentOperation operation) private async Task ValidateCore(ContentOperation operation)
{ {
operation.MustHavePermission(Permissions.AppContentsReadOwn); operation.MustHavePermission(Permissions.AppContentsRead);
await operation.ValidateContentAndInputAsync(Snapshot.Data, false, Snapshot.IsPublished()); await operation.ValidateContentAndInputAsync(Snapshot.Data, false, Snapshot.IsPublished());
} }
@ -408,7 +408,7 @@ namespace Squidex.Domain.Apps.Entities.Contents.DomainObject
private async Task DeleteCore(DeleteContent c, ContentOperation operation) private async Task DeleteCore(DeleteContent c, ContentOperation operation)
{ {
operation.MustHavePermission(Permissions.AppContentsDeleteOwn); operation.MustHavePermission(Permissions.AppContentsDelete);
operation.MustNotDeleteSingleton(); operation.MustNotDeleteSingleton();
if (!c.DoNotScript) if (!c.DoNotScript)

4
frontend/src/app/features/schemas/pages/schema/scripts/schema-scripts-form.component.ts

@ -6,7 +6,7 @@
*/ */
import { Component, Input, OnChanges } from '@angular/core'; import { Component, Input, OnChanges } from '@angular/core';
import { EMPTY, Observable } from 'rxjs'; import { EMPTY, Observable, shareReplay } from 'rxjs';
import { AppsState, EditSchemaScriptsForm, SchemaCompletions, SchemaDto, SchemasService, SchemasState } from '@app/shared'; import { AppsState, EditSchemaScriptsForm, SchemaCompletions, SchemaDto, SchemasService, SchemasState } from '@app/shared';
@Component({ @Component({
@ -38,7 +38,7 @@ export class SchemaScriptsFormComponent implements OnChanges {
this.editForm.load(this.schema.scripts); this.editForm.load(this.schema.scripts);
this.editForm.setEnabled(this.isEditable); this.editForm.setEnabled(this.isEditable);
this.schemaCompletions = this.schemasService.getCompletions(this.appsState.appName, this.schema.name); this.schemaCompletions = this.schemasService.getCompletions(this.appsState.appName, this.schema.name).pipe(shareReplay(1));
} }
public selectField(field: string) { public selectField(field: string) {

4
frontend/src/app/features/settings/pages/asset-scripts/asset-scripts-page.component.ts

@ -6,7 +6,7 @@
*/ */
import { Component, OnInit } from '@angular/core'; import { Component, OnInit } from '@angular/core';
import { EMPTY, Observable } from 'rxjs'; import { EMPTY, Observable, shareReplay } from 'rxjs';
import { AppsState, AssetCompletions, AssetScriptsState, AssetsService, EditAssetScriptsForm, ResourceOwner } from '@app/shared'; import { AppsState, AssetCompletions, AssetScriptsState, AssetsService, EditAssetScriptsForm, ResourceOwner } from '@app/shared';
@Component({ @Component({
@ -31,7 +31,7 @@ export class AssetScriptsPageComponent extends ResourceOwner implements OnInit {
} }
public ngOnInit() { public ngOnInit() {
this.assetCompletions = this.assetsService.getCompletions(this.appsState.appName); this.assetCompletions = this.assetsService.getCompletions(this.appsState.appName).pipe(shareReplay(1));
this.assetScriptsState.scripts this.assetScriptsState.scripts
.subscribe(scripts => { .subscribe(scripts => {

Loading…
Cancel
Save