Docker/portainer
Docker/portainer
1
0
Fork 0
mirror of https://github.com/portainer/portainer.git synced 2025-07-24 07:49:41 +02:00
Code Issues Releases Activity

fix(service): webhook vulnerability for passing an invalid image tag EE-2121 (#6269)

Browse source 
* fix(service): webhook vulnerability for passing an invalid image tag
This commit is contained in:
Hao Zhang 2022-01-27 08:38:29 +08:00 • committed by GitHub
parent dfb0ba9efe
commit a9406764ee
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 115 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
api/internal/authorization/authorizations.go
View file

@ -603,3 +603,21 @@ func getAuthorizationsFromRoles(roleIdentifiers []portainer.RoleID, roles []port
return authorizations
}
func (service *Service) UserIsAdminOrAuthorized(userID portainer.UserID, endpointID portainer.EndpointID, authorizations []portainer.Authorization) (bool, error) {
user, err := service.dataStore.User().User(userID)
if err != nil {
return false, err
}
if user.Role == portainer.AdministratorRole {
return true, nil
}
for _, authorization := range authorizations {
_, authorized := user.EndpointAuthorizations[endpointID][authorization]
if authorized {
return true, nil
}
}
return false, nil
}