Fixed missing auth check in Export Users
MODIFY
src/authorization/Authorizations.ts
src/authorization/Authorizations.ts
@@ -387,6 +387,10 @@ export default class Authorizations {
return Authorizations.can(loggedUser, Entity.USER, Action.IMPORT, authContext);
}
+ public static async canExportUsers(loggedUser: UserToken, authContext?: AuthorizationContext): Promise<AuthorizationResult> {
+ return Authorizations.can(loggedUser, Entity.USER, Action.EXPORT, authContext);
+ }
+
public static async canUpdateUser(loggedUser: UserToken, authContext?: AuthorizationContext): Promise<AuthorizationResult> {
return Authorizations.can(loggedUser, Entity.USER, Action.UPDATE, authContext);
}

MODIFY
src/server/rest/v1/service/TagService.ts
src/server/rest/v1/service/TagService.ts
@@ -607,8 +607,8 @@ export default class TagService {
throw new AppAuthError({
errorCode: HTTPAuthError.FORBIDDEN,
user: req.user,
- action: Action.IMPORT, entity: Entity.TAG,
- module: MODULE_NAME, method: 'handleImportTags'
+ action: Action.EXPORT, entity: Entity.TAG,
+ module: MODULE_NAME, method: 'handleExportTags'
});
}
// Force params

MODIFY
src/server/rest/v1/service/UserService.ts
src/server/rest/v1/service/UserService.ts
@@ -315,6 +315,15 @@ export default class UserService {
}
public static async handleExportUsers(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
+ // Check auth
+ if (!(await Authorizations.canExportUsers(req.user)).authorized) {
+ throw new AppAuthError({
+ errorCode: HTTPAuthError.FORBIDDEN,
+ user: req.user,
+ action: Action.EXPORT, entity: Entity.USER,
+ module: MODULE_NAME, method: 'handleExportUsers'
+ });
+ }
// Force params
req.query.Limit = Constants.EXPORT_PAGE_SIZE.toString();
// Filter

Fixed missing auth check in Export Users