Skip to content

Commit 96fdec6

Browse files
sguiheuxsguiheux
authored
fix(api): action name can contain space (#6279)
1 parent b309ce9 commit 96fdec6

File tree

2 files changed

+71
-11
lines changed

2 files changed

+71
-11
lines changed

‎engine/api/action.go

+58-9
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"io"
66
"net/http"
7+
"net/url"
78

89
"github.com/go-gorp/gorp"
910
"github.com/gorilla/mux"
@@ -186,7 +187,12 @@ func (api *API) getActionHandler() service.Handler {
186187
vars := mux.Vars(r)
187188

188189
groupName := vars["permGroupName"]
189-
actionName := vars["permActionName"]
190+
actionNameEscaped := vars["permActionName"]
191+
192+
actionName, err := url.PathUnescape(actionNameEscaped)
193+
if err != nil {
194+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
195+
}
190196

191197
g, err := group.LoadByName(ctx, api.mustDB(), groupName, group.LoadOptions.WithMembers)
192198
if err != nil {
@@ -221,7 +227,13 @@ func (api *API) putActionHandler() service.Handler {
221227
vars := mux.Vars(r)
222228

223229
groupName := vars["permGroupName"]
224-
actionName := vars["permActionName"]
230+
231+
actionNameEscaped := vars["permActionName"]
232+
233+
actionName, err := url.PathUnescape(actionNameEscaped)
234+
if err != nil {
235+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
236+
}
225237

226238
g, err := group.LoadByName(ctx, api.mustDB(), groupName)
227239
if err != nil {
@@ -318,7 +330,13 @@ func (api *API) deleteActionHandler() service.Handler {
318330
vars := mux.Vars(r)
319331

320332
groupName := vars["permGroupName"]
321-
actionName := vars["permActionName"]
333+
334+
actionNameEscaped := vars["permActionName"]
335+
336+
actionName, err := url.PathUnescape(actionNameEscaped)
337+
if err != nil {
338+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
339+
}
322340

323341
g, err := group.LoadByName(ctx, api.mustDB(), groupName)
324342
if err != nil {
@@ -364,7 +382,13 @@ func (api *API) getActionAuditHandler() service.Handler {
364382
vars := mux.Vars(r)
365383

366384
groupName := vars["permGroupName"]
367-
actionName := vars["permActionName"]
385+
386+
actionNameEscaped := vars["permActionName"]
387+
388+
actionName, err := url.PathUnescape(actionNameEscaped)
389+
if err != nil {
390+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
391+
}
368392

369393
g, err := group.LoadByName(ctx, api.mustDB(), groupName)
370394
if err != nil {
@@ -440,7 +464,12 @@ func (api *API) postActionAuditRollbackHandler() service.Handler {
440464
vars := mux.Vars(r)
441465

442466
groupName := vars["permGroupName"]
443-
actionName := vars["permActionName"]
467+
actionNameEscaped := vars["permActionName"]
468+
469+
actionName, err := url.PathUnescape(actionNameEscaped)
470+
if err != nil {
471+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
472+
}
444473

445474
auditID, err := requestVarInt(r, "auditID")
446475
if err != nil {
@@ -575,7 +604,12 @@ func (api *API) getActionUsageHandler() service.Handler {
575604
vars := mux.Vars(r)
576605

577606
groupName := vars["permGroupName"]
578-
actionName := vars["permActionName"]
607+
actionNameEscaped := vars["permActionName"]
608+
609+
actionName, err := url.PathUnescape(actionNameEscaped)
610+
if err != nil {
611+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
612+
}
579613

580614
g, err := group.LoadByName(ctx, api.mustDB(), groupName)
581615
if err != nil {
@@ -604,7 +638,12 @@ func (api *API) getActionExportHandler() service.Handler {
604638
vars := mux.Vars(r)
605639

606640
groupName := vars["permGroupName"]
607-
actionName := vars["permActionName"]
641+
actionNameEscaped := vars["permActionName"]
642+
643+
actionName, err := url.PathUnescape(actionNameEscaped)
644+
if err != nil {
645+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
646+
}
608647

609648
format := FormString(r, "format")
610649
if format == "" {
@@ -800,7 +839,12 @@ func (api *API) getActionBuiltinHandler() service.Handler {
800839
return func(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
801840
vars := mux.Vars(r)
802841

803-
actionName := vars["permActionBuiltinName"]
842+
actionNameEscaped := vars["permActionBuiltinName"]
843+
844+
actionName, err := url.PathUnescape(actionNameEscaped)
845+
if err != nil {
846+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
847+
}
804848

805849
a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, actionName,
806850
action.LoadOptions.WithRequirements,
@@ -822,7 +866,12 @@ func (api *API) getActionBuiltinUsageHandler() service.Handler {
822866
return func(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
823867
vars := mux.Vars(r)
824868

825-
actionName := vars["permActionBuiltinName"]
869+
actionNameEscaped := vars["permActionBuiltinName"]
870+
871+
actionName, err := url.PathUnescape(actionNameEscaped)
872+
if err != nil {
873+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
874+
}
826875

827876
a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, actionName,
828877
action.LoadOptions.WithRequirements,

‎engine/api/router_middleware_auth_permission.go

+13-2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package api
33
import (
44
"context"
55
"net/http"
6+
"net/url"
67
"strconv"
78

89
"github.com/rockbears/log"
@@ -406,7 +407,12 @@ func (api *API) checkActionPermissions(ctx context.Context, w http.ResponseWrite
406407
return err
407408
}
408409

409-
a, err := action.LoadTypeDefaultByNameAndGroupID(ctx, api.mustDB(), actionName, g.ID)
410+
name, err := url.PathUnescape(actionName)
411+
if err != nil {
412+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
413+
}
414+
415+
a, err := action.LoadTypeDefaultByNameAndGroupID(ctx, api.mustDB(), name, g.ID)
410416
if err != nil {
411417
return err
412418
}
@@ -422,7 +428,12 @@ func (api *API) checkActionBuiltinPermissions(ctx context.Context, w http.Respon
422428
return sdk.WrapError(sdk.ErrWrongRequest, "invalid given action name")
423429
}
424430

425-
a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, actionName)
431+
name, err := url.PathUnescape(actionName)
432+
if err != nil {
433+
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "%s", err)
434+
}
435+
436+
a, err := action.LoadByTypesAndName(ctx, api.mustDB(), []string{sdk.BuiltinAction, sdk.PluginAction}, name)
426437
if err != nil {
427438
return err
428439
}

0 commit comments

Comments
 (0)