Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-03 23:00:14 -05:00
Code Issues Activity

🔒 Fixed permissible method for Integration Model

Browse source 
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-j5c2-hm46-wp5c

The permissible method of models overrides all permission logic, which
means we must manually check the user & api key permissions before
continuing.
This commit is contained in:
Fabien O'Carroll 2021-07-16 14:26:35 +01:00 • committed by Daniel Lockyer
parent ba7ddc88c1
commit 1962591c2e
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
core/server/models/integration.js
View file

@ -1,5 +1,6 @@
const limitService = require('../services/limits'); const limitService = require('../services/limits');
const ghostBookshelf = require('./base'); const ghostBookshelf = require('./base');
const {NoPermissionError} = require('@tryghost/errors');
const Integration = ghostBookshelf.Model.extend({ const Integration = ghostBookshelf.Model.extend({
tableName: 'integrations', tableName: 'integrations',
@ -63,7 +64,7 @@ const Integration = ghostBookshelf.Model.extend({
return options; return options;
}, },
async permissible(integrationModel, action) { async permissible(integrationModel, action, context, attrs, loadedPerms, hasUserPermission, hasApiKeyPermission) {
const isAdd = (action === 'add'); const isAdd = (action === 'add');
if (isAdd && limitService.isLimited('customIntegrations')) { if (isAdd && limitService.isLimited('customIntegrations')) {
@ -71,7 +72,10 @@ const Integration = ghostBookshelf.Model.extend({
// Inviting a new custom integration requires we check we won't go over the limit // Inviting a new custom integration requires we check we won't go over the limit
await limitService.errorIfWouldGoOverLimit('customIntegrations'); await limitService.errorIfWouldGoOverLimit('customIntegrations');
} }
return true;
if (!hasUserPermission || !hasApiKeyPermission) {
throw new NoPermissionError();
}
} }
}); });