From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 30 May 2019 11:00:17 +0000 (+0100)
Subject: wiki: Enforce ACLs for watchers
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=516da0a9198d3fecb501c4bff5e6b298f6775254;p=ipfire.org.git

wiki: Enforce ACLs for watchers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/backend/wiki.py b/src/backend/wiki.py
index 9e5878c6..51aa2b26 100644
--- a/src/backend/wiki.py
+++ b/src/backend/wiki.py
@@ -525,6 +525,11 @@ class Page(misc.Object):
 				logging.debug("Excluding %s" % watcher)
 				continue
 
+			# Check permissions
+			if not self.backend.wiki.check_acl(self.page, watcher):
+				logging.debug("Watcher %s does not have permissions" % watcher)
+				continue
+
 			logging.debug("Sending watcher email to %s" % watcher)
 
 			# Compose message
diff --git a/src/web/wiki.py b/src/web/wiki.py
index e127a37d..5a37ea22 100644
--- a/src/web/wiki.py
+++ b/src/web/wiki.py
@@ -91,6 +91,10 @@ class ActionWatchHandler(auth.CacheMixin, base.BaseHandler):
 		if not page:
 			raise tornado.web.HTTPError(404, "Page does not exist: %s" % path)
 
+		# Check permissions
+		if not self.backend.wiki.check_acl(path, self.current_user):
+			raise tornado.web.HTTPError(403, "Access to %s not allowed for %s" % (path, self.current_user))
+
 		with self.db.transaction():
 			if action == "watch":
 				page.add_watcher(self.current_user)