uploads: Check if client has permissions to access an upload

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/web/base.py b/src/web/base.py
index e67ca7dfaaa52e250f90b9bd85a3d8215aded9b5..9a193b63cfced6b062b46dbbc1f5b62c0ce7b8a9 100644 (file)
--- a/src/web/base.py
+++ b/src/web/base.py
@@ -253,6 +253,17 @@ class BaseHandler(tornado.web.RequestHandler):
                if slug:
                        return self.backend.distros.get_by_slug(slug)
 
+       # Uploads
+
+       def _get_upload(self, uuid):
+               upload = self.backend.uploads.get_by_uuid(uuid)
+
+               # Check permissions
+               if upload and not upload.has_perm(self.current_user):
+                       raise tornado.web.HTTPError(403, "%s has no permissions for upload %s" % (self.current_user, upload))
+
+               return upload
+
        def get_argument_upload(self, *args, **kwargs):
                """
                        Returns an upload
@@ -260,7 +271,7 @@ class BaseHandler(tornado.web.RequestHandler):
                uuid = self.get_argument(*args, **kwargs)
 
                if uuid:
-                       return self.backend.uploads.get_by_uuid(uuid)
+                       return self._get_upload(uuid)
 
        def get_argument_uploads(self, *args, **kwargs):
                """
@@ -269,7 +280,7 @@ class BaseHandler(tornado.web.RequestHandler):
                uuids = self.get_arguments(*args, **kwargs)
 
                # Return all uploads
-               return [self.backend.uploads.get_by_uuid(uuid) for uuid in uuids]
+               return [self._get_upload(uuid) for uuid in uuids]
 
        def get_argument_user(self, *args, **kwargs):
                name = self.get_argument(*args, **kwargs)