From 0d5a1b36c704f3a79eceb2a1f19894f0438eb1b0 Mon Sep 17 00:00:00 2001 From: Abyss777 Date: Thu, 20 Jul 2017 10:05:33 +0500 Subject: Make permissions resources more strict --- src/org/traccar/api/resource/DeviceResource.java | 6 ++++++ src/org/traccar/api/resource/GroupResource.java | 6 ++++++ src/org/traccar/api/resource/PermissionsResource.java | 6 ++++++ 3 files changed, 18 insertions(+) (limited to 'src/org/traccar') diff --git a/src/org/traccar/api/resource/DeviceResource.java b/src/org/traccar/api/resource/DeviceResource.java index 41a8970e2..0f7579bae 100644 --- a/src/org/traccar/api/resource/DeviceResource.java +++ b/src/org/traccar/api/resource/DeviceResource.java @@ -125,6 +125,9 @@ public class DeviceResource extends BaseResource { @POST public Response add(Map entity) throws SQLException { Context.getPermissionsManager().checkReadonly(getUserId()); + if (entity.size() != 2) { + throw new IllegalArgumentException(); + } for (String key : entity.keySet()) { Context.getPermissionsManager().checkPermission(key.replace("Id", ""), getUserId(), entity.get(key)); } @@ -140,6 +143,9 @@ public class DeviceResource extends BaseResource { for (String key : entity.keySet()) { Context.getPermissionsManager().checkPermission(key.replace("Id", ""), getUserId(), entity.get(key)); } + if (entity.size() != 2) { + throw new IllegalArgumentException(); + } Context.getDataManager().linkObject(entity, false); Context.getPermissionsManager().refreshPermissions(entity); return Response.noContent().build(); diff --git a/src/org/traccar/api/resource/GroupResource.java b/src/org/traccar/api/resource/GroupResource.java index 97b6d671d..0d9572332 100644 --- a/src/org/traccar/api/resource/GroupResource.java +++ b/src/org/traccar/api/resource/GroupResource.java @@ -97,6 +97,9 @@ public class GroupResource extends BaseResource { @POST public Response add(Map entity) throws SQLException { Context.getPermissionsManager().checkReadonly(getUserId()); + if (entity.size() != 2) { + throw new IllegalArgumentException(); + } for (String key : entity.keySet()) { Context.getPermissionsManager().checkPermission(key.replace("Id", ""), getUserId(), entity.get(key)); } @@ -109,6 +112,9 @@ public class GroupResource extends BaseResource { @DELETE public Response remove(Map entity) throws SQLException { Context.getPermissionsManager().checkReadonly(getUserId()); + if (entity.size() != 2) { + throw new IllegalArgumentException(); + } for (String key : entity.keySet()) { Context.getPermissionsManager().checkPermission(key.replace("Id", ""), getUserId(), entity.get(key)); } diff --git a/src/org/traccar/api/resource/PermissionsResource.java b/src/org/traccar/api/resource/PermissionsResource.java index ac7acb93f..e22ffae36 100644 --- a/src/org/traccar/api/resource/PermissionsResource.java +++ b/src/org/traccar/api/resource/PermissionsResource.java @@ -39,6 +39,9 @@ public class PermissionsResource extends BaseResource { @POST public Response add(Map entity) throws SQLException { Context.getPermissionsManager().checkReadonly(getUserId()); + if (entity.size() != 2) { + throw new IllegalArgumentException(); + } for (String key : entity.keySet()) { Context.getPermissionsManager().checkPermission(key.replace("Id", ""), getUserId(), entity.get(key)); } @@ -51,6 +54,9 @@ public class PermissionsResource extends BaseResource { @DELETE public Response remove(Map entity) throws SQLException { Context.getPermissionsManager().checkReadonly(getUserId()); + if (entity.size() != 2) { + throw new IllegalArgumentException(); + } for (String key : entity.keySet()) { Context.getPermissionsManager().checkPermission(key.replace("Id", ""), getUserId(), entity.get(key)); } -- cgit v1.2.3