Mirrors/shlink
1
0
Fork 0
mirror of https://github.com/shlinkio/shlink.git synced 2026-03-10 17:23:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Ensured delete/rename tags cannot be done with non-admin API keys

Browse Source
This commit is contained in:
Alejandro Celaya
2021-01-06 17:31:49 +01:00
parent b5710f87e2
commit a8b68f07b5
9 changed files with 177 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
module/Rest/src/Action/Tag/DeleteTagsAction.php
View File

@@ -9,6 +9,7 @@ use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Shlinkio\Shlink\Core\Tag\TagServiceInterface;
use Shlinkio\Shlink\Rest\Action\AbstractRestAction;
use Shlinkio\Shlink\Rest\Middleware\AuthenticationMiddleware;
class DeleteTagsAction extends AbstractRestAction
{
@@ -26,8 +27,9 @@ class DeleteTagsAction extends AbstractRestAction
{
$query = $request->getQueryParams();
$tags = $query['tags'] ?? [];
$apiKey = AuthenticationMiddleware::apiKeyFromRequest($request);
$this->tagService->deleteTags($tags);
$this->tagService->deleteTags($tags, $apiKey);
return new EmptyResponse();
}
}

12
module/Rest/src/Action/Tag/UpdateTagAction.php
View File

@@ -10,6 +10,7 @@ use Psr\Http\Message\ServerRequestInterface;
use Shlinkio\Shlink\Core\Tag\Model\TagRenaming;
use Shlinkio\Shlink\Core\Tag\TagServiceInterface;
use Shlinkio\Shlink\Rest\Action\AbstractRestAction;
use Shlinkio\Shlink\Rest\Middleware\AuthenticationMiddleware;
class UpdateTagAction extends AbstractRestAction
{
@@ -23,17 +24,12 @@ class UpdateTagAction extends AbstractRestAction
$this->tagService = $tagService;
}
/**
* Process an incoming server request and return a response, optionally delegating
* to the next middleware component to create the response.
*
*
* @throws \InvalidArgumentException
*/
public function handle(ServerRequestInterface $request): ResponseInterface
{
$body = $request->getParsedBody();
$this->tagService->renameTag(TagRenaming::fromArray($body));
$apiKey = AuthenticationMiddleware::apiKeyFromRequest($request);
$this->tagService->renameTag(TagRenaming::fromArray($body), $apiKey);
return new EmptyResponse();
}
}