Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check permissions when applying tag in filter #1222

Merged
merged 4 commits into from
Aug 5, 2020
Merged

Check permissions when applying tag in filter #1222

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9936920
Add missing paren
mattmundell Aug 4, 2020
8f4edad
Check permissions when applying tag in filter
mattmundell Aug 4, 2020
ed23d10
Indent SQL that had error more hierarchically
mattmundell Aug 4, 2020
631798b
Update changelog
mattmundell Aug 4, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Quote identifiers in SQL functions using EXECUTE [#1192](https://github.com/greenbone/gvmd/pull/1192)
- Fix handling of interrupted tasks [#1207](https://github.com/greenbone/gvmd/pull/1207)
- Allow group access to lockfile and fix growing or empty timestamp [#1213](https://github.com/greenbone/gvmd/pull/1213)
- Check permissions when applying tag in filter [#1222](https://github.com/greenbone/gvmd/pull/1222)

### Removed
- Remove support for "All SecInfo": removal of "allinfo" for type in get_info [#790](https://github.com/greenbone/gvmd/pull/790)
Expand Down
26 changes: 13 additions & 13 deletions src/manage_pg.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -858,19 +858,19 @@ manage_create_sql_functions ()
" THEN RETURN true;"
" ELSE RETURN false;"
" END CASE;"
" ELSE"
" EXECUTE"
" 'SELECT EXISTS (SELECT * FROM '"
" || quote_ident_split ($1 || 's') || '"
" WHERE id = $2"
" AND ((owner IS NULL)"
" OR (owner = (SELECT id FROM users"
" WHERE users.uuid"
" = (SELECT current_setting"
" (''gvmd.user.uuid'')))))'"
" USING arg_type, arg_id"
" INTO owns;"
" RETURN owns;"
" ELSE EXECUTE"
" 'SELECT"
" EXISTS (SELECT *"
" FROM ' || quote_ident_split ($1 || 's') || '"
" WHERE id = $2"
" AND ((owner IS NULL)"
" OR (owner = (SELECT id FROM users"
" WHERE users.uuid"
" = (SELECT current_setting"
" (''gvmd.user.uuid''))))))'"
" USING arg_type, arg_id"
" INTO owns;"
" RETURN owns;"
" END CASE;"
" END;"
"$$ LANGUAGE plpgsql;");
Expand Down
24 changes: 24 additions & 0 deletions src/manage_sql.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2651,6 +2651,10 @@ filter_clause_append_tag (GString *clause, keyword_t *keyword,
" (SELECT * FROM tags"
" WHERE tags.name = '%s'"
" AND tags.active != 0"
" AND user_has_access_uuid (CAST ('tag' AS text),"
" CAST (tags.uuid AS text),"
" CAST ('get_tags' AS text),"
" 0)"
" AND EXISTS (SELECT * FROM tag_resources"
" WHERE tag_resources.resource_uuid"
" = %ss.uuid"
Expand Down Expand Up @@ -2680,6 +2684,10 @@ filter_clause_append_tag (GString *clause, keyword_t *keyword,
" (SELECT * FROM tags"
" WHERE tags.name %s '%%%%%s%%%%'"
" AND tags.active != 0"
" AND user_has_access_uuid (CAST ('tag' AS text),"
" CAST (tags.uuid AS text),"
" CAST ('get_tags' AS text),"
" 0)"
" AND EXISTS (SELECT * FROM tag_resources"
" WHERE tag_resources.resource_uuid"
" = %ss.uuid"
Expand All @@ -2705,6 +2713,10 @@ filter_clause_append_tag (GString *clause, keyword_t *keyword,
" (SELECT * FROM tags"
" WHERE tags.name %s '%s'"
" AND tags.active != 0"
" AND user_has_access_uuid (CAST ('tag' AS text),"
" CAST (tags.uuid AS text),"
" CAST ('get_tags' AS text),"
" 0)"
" AND EXISTS (SELECT * FROM tag_resources"
" WHERE tag_resources.resource_uuid"
" = %ss.uuid"
Expand Down Expand Up @@ -2758,6 +2770,10 @@ filter_clause_append_tag_id (GString *clause, keyword_t *keyword,
"(EXISTS"
" (SELECT * FROM tags"
" WHERE tags.uuid = '%s'"
" AND user_has_access_uuid (CAST ('tag' AS text),"
" CAST (tags.uuid AS text),"
" CAST ('get_tags' AS text),"
" 0)"
" AND EXISTS (SELECT * FROM tag_resources"
" WHERE tag_resources.resource_uuid"
" = %ss.uuid"
Expand All @@ -2779,6 +2795,10 @@ filter_clause_append_tag_id (GString *clause, keyword_t *keyword,
" (SELECT * FROM tags"
" WHERE tags.uuid %s '%%%%%s%%%%'"
" AND tags.active != 0"
" AND user_has_access_uuid (CAST ('tag' AS text),"
" CAST (tags.uuid AS text),"
" CAST ('get_tags' AS text),"
" 0)"
" AND EXISTS (SELECT * FROM tag_resources"
" WHERE tag_resources.resource_uuid"
" = %ss.uuid"
Expand All @@ -2801,6 +2821,10 @@ filter_clause_append_tag_id (GString *clause, keyword_t *keyword,
" (SELECT * FROM tags"
" WHERE tags.uuid %s '%s'"
" AND tags.active != 0"
" AND user_has_access_uuid (CAST ('tag' AS text),"
" CAST (tags.uuid AS text),"
" CAST ('get_tags' AS text),"
" 0)"
" AND EXISTS (SELECT * FROM tag_resources"
" WHERE tag_resources.resource_uuid"
" = %ss.uuid"
Expand Down