Restrict lab credentials import to users with edit-users privilege

JanWichelmann · Oct 16, 2024 · 63a9ab6 · 63a9ab6
1 parent 6f74a0c
commit 63a9ab6
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/Ctf4e.Server/Controllers/AdminUsersController.cs b/src/Ctf4e.Server/Controllers/AdminUsersController.cs
@@ -196,6 +196,7 @@ public async Task<IActionResult> ExportLabCredentialsAsync()
     }
 
     [HttpPost("credentials/import")]
+    [AnyUserPrivilege(UserPrivileges.EditUsers)]
     [ValidateAntiForgeryToken]
     public async Task<IActionResult> ImportLabCredentialsAsync(IFormFile credentialsFile)
     {

diff --git a/src/Ctf4e.Server/Views/Admin/Users/Index.cshtml b/src/Ctf4e.Server/Views/Admin/Users/Index.cshtml
@@ -178,10 +178,10 @@
     <form class="mb-3" enctype="multipart/form-data" method="post" asp-controller="AdminUsers" asp-action="ImportLabCredentials">
         <div class="row">
             <div class="col-auto">
-                <input class="form-control" type="file" id="credentialsFile" name="credentialsFile">
+                <input class="form-control" type="file" id="credentialsFile" name="credentialsFile" disabled="@(!currentUser.Privileges.HasAnyPrivilege(UserPrivileges.EditUsers))">
             </div>
             <div class="col">
-                <button type="submit" class="btn btn-outline-danger">
+                <button type="submit" class="btn btn-outline-danger" disabled="@(!currentUser.Privileges.HasAnyPrivilege(UserPrivileges.EditUsers))">
                     <i class="bi bi-upload"></i>
                     @Localizer["ImportLabCredentials"]
                 </button>