Skip to content

Commit f63d9c8

Browse files
rxturrxtur
committed
Various fixes including hardening repository (3.2.0.3)
1 parent ccda929 commit f63d9c8

File tree

19 files changed

+108
-89
lines changed

19 files changed

+108
-89
lines changed

‎BlogEngine/BlogEngine.Core/Data/BlogRepository.cs‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,17 @@ public class BlogRepository : IBlogRepository
2222
/// <param name="filter">Filter expression</param>
2323
/// <param name="order">Order expression</param>
2424
/// <returns>List of blogs</returns>
25-
public IEnumerable<BlogEngine.Core.Data.Models.Blog> Find(int take = 10, int skip = 0, string filter = "", string order = "")
25+
public IEnumerable<Models.Blog> Find(int take = 10, int skip = 0, string filter = "", string order = "")
2626
{
2727
// sub-blogs not allowed to see other blogs
2828
if (!(Blog.CurrentInstance.IsPrimary && Security.IsAdministrator))
29-
throw new System.UnauthorizedAccessException();
29+
throw new UnauthorizedAccessException();
3030

3131
if (take == 0) take = Blog.Blogs.Count;
3232
if (string.IsNullOrEmpty(filter)) filter = "1==1";
3333
if (string.IsNullOrEmpty(order)) order = "Name";
3434

35-
var items = new List<BlogEngine.Core.Data.Models.Blog>();
35+
var items = new List<Models.Blog>();
3636
var query = Blog.Blogs.AsQueryable().Where(filter);
3737

3838
foreach (var item in query.OrderBy(order).Skip(skip).Take(take))
@@ -46,11 +46,11 @@ public class BlogRepository : IBlogRepository
4646
/// </summary>
4747
/// <param name="id">Id</param>
4848
/// <returns>Blog</returns>
49-
public BlogEngine.Core.Data.Models.Blog FindById(Guid id)
49+
public Models.Blog FindById(Guid id)
5050
{
5151
// sub-blogs not allowed to see other blogs
5252
if (!(Blog.CurrentInstance.IsPrimary && Security.IsAdministrator))
53-
throw new System.UnauthorizedAccessException();
53+
throw new UnauthorizedAccessException();
5454

5555
var blog = Blog.Blogs.Where(b => b.Id == id).FirstOrDefault();
5656
return ToJson(blog);
@@ -61,12 +61,12 @@ public BlogEngine.Core.Data.Models.Blog FindById(Guid id)
6161
/// </summary>
6262
/// <param name="item">Blog item</param>
6363
/// <returns>Saved blog with new ID</returns>
64-
public BlogEngine.Core.Data.Models.Blog Add(BlogItem item)
64+
public Models.Blog Add(BlogItem item)
6565
{
6666
// has to be on primary blog and be an admin
6767
// or blog allows create new on self registration
6868
if (!(Blog.CurrentInstance.IsPrimary && (Security.IsAdministrator || BlogSettings.Instance.CreateBlogOnSelfRegistration)))
69-
throw new System.UnauthorizedAccessException();
69+
throw new UnauthorizedAccessException();
7070

7171
string message;
7272
if (!BlogGenerator.ValidateProperties(item.Name, item.UserName, item.Email, out message))
@@ -85,11 +85,11 @@ public BlogEngine.Core.Data.Models.Blog Add(BlogItem item)
8585
/// </summary>
8686
/// <param name="blog">Blog to update</param>
8787
/// <returns>True on success</returns>
88-
public bool Update(BlogEngine.Core.Data.Models.Blog blog)
88+
public bool Update(Models.Blog blog)
8989
{
9090
// sub-blogs not allowed to see other blogs
9191
if (!(Blog.CurrentInstance.IsPrimary && Security.IsAdministrator))
92-
throw new System.UnauthorizedAccessException();
92+
throw new UnauthorizedAccessException();
9393
try
9494
{
9595
var coreBlog = Blog.Blogs.Where(b => b.Id == blog.Id).FirstOrDefault();
@@ -110,7 +110,7 @@ public bool Remove(Guid id)
110110
{
111111
// sub-blogs not allowed to see other blogs
112112
if (!(Blog.CurrentInstance.IsPrimary && Security.IsAdministrator))
113-
throw new System.UnauthorizedAccessException();
113+
throw new UnauthorizedAccessException();
114114
try
115115
{
116116
var blog = Blog.Blogs.Where(b => b.Id == id).FirstOrDefault();

‎BlogEngine/BlogEngine.Core/Data/CategoryRepository.cs‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ public class CategoryRepository : ICategoryRepository
2222
/// <returns>List of items</returns>
2323
public IEnumerable<CategoryItem> Find(int take = 10, int skip = 0, string filter = "", string order = "")
2424
{
25-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.ViewPublicPosts))
26-
throw new System.UnauthorizedAccessException();
25+
if (!Security.IsAuthorizedTo(Rights.ViewPublicPosts))
26+
throw new UnauthorizedAccessException();
2727

2828
// get post categories with counts
2929
var items = new List<CategoryItem>();
30-
foreach (var p in BlogEngine.Core.Post.ApplicablePosts)
30+
foreach (var p in Post.ApplicablePosts)
3131
{
3232
foreach (var c in p.Categories)
3333
{
@@ -66,20 +66,20 @@ public IEnumerable<CategoryItem> Find(int take = 10, int skip = 0, string filter
6666
/// </summary>
6767
/// <param name="id">Item id</param>
6868
/// <returns>Object</returns>
69-
public Data.Models.CategoryItem FindById(Guid id)
69+
public CategoryItem FindById(Guid id)
7070
{
71-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.ViewPublicPosts))
72-
throw new System.UnauthorizedAccessException();
71+
if (!Security.IsAuthorizedTo(Rights.ViewPublicPosts))
72+
throw new UnauthorizedAccessException();
7373

7474
// get post categories
75-
var items = new List<Data.Models.CategoryItem>();
76-
foreach (var p in BlogEngine.Core.Post.ApplicablePosts)
75+
var items = new List<CategoryItem>();
76+
foreach (var p in Post.ApplicablePosts)
7777
{
7878
foreach (var c in p.Categories)
7979
{
8080
var tmp = items.FirstOrDefault(cat => cat.Id == c.Id);
8181
if (tmp == null)
82-
items.Add(new Data.Models.CategoryItem { Id = c.Id, Parent = OptionById(c.Parent), Title = c.Title, Description = c.Description, Count = 1 });
82+
items.Add(new CategoryItem { Id = c.Id, Parent = OptionById(c.Parent), Title = c.Title, Description = c.Description, Count = 1 });
8383
else
8484
tmp.Count++;
8585
}
@@ -89,7 +89,7 @@ public Data.Models.CategoryItem FindById(Guid id)
8989
{
9090
var x = items.Where(i => i.Id == c.Id).FirstOrDefault();
9191
if (x == null)
92-
items.Add(new Data.Models.CategoryItem { Id = c.Id, Parent = OptionById(c.Parent), Title = c.Title, Description = c.Description, Count = 0 });
92+
items.Add(new CategoryItem { Id = c.Id, Parent = OptionById(c.Parent), Title = c.Title, Description = c.Description, Count = 0 });
9393
}
9494
return items.Where(c => c.Id == id).FirstOrDefault();
9595
}
@@ -98,10 +98,10 @@ public Data.Models.CategoryItem FindById(Guid id)
9898
/// </summary>
9999
/// <param name="item">Post</param>
100100
/// <returns>Saved item with new ID</returns>
101-
public Data.Models.CategoryItem Add(CategoryItem item)
101+
public CategoryItem Add(CategoryItem item)
102102
{
103-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.CreateNewPosts))
104-
throw new System.UnauthorizedAccessException();
103+
if (!Security.IsAuthorizedTo(Rights.CreateNewPosts))
104+
throw new UnauthorizedAccessException();
105105

106106
var cat = (from c in Category.Categories.ToList() where c.Title == item.Title select c).FirstOrDefault();
107107
if (cat != null)
@@ -126,8 +126,8 @@ public Data.Models.CategoryItem Add(CategoryItem item)
126126
/// <returns>True on success</returns>
127127
public bool Update(CategoryItem item)
128128
{
129-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.EditOwnPosts))
130-
throw new System.UnauthorizedAccessException();
129+
if (!Security.IsAuthorizedTo(Rights.EditOwnPosts))
130+
throw new UnauthorizedAccessException();
131131

132132
var cat = (from c in Category.Categories.ToList() where c.Title == item.Title && c.Id != item.Id select c).FirstOrDefault();
133133
if (cat != null)
@@ -149,8 +149,8 @@ public bool Update(CategoryItem item)
149149
/// <returns>True on success</returns>
150150
public bool Remove(Guid id)
151151
{
152-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.DeleteOwnPosts))
153-
throw new System.UnauthorizedAccessException();
152+
if (!Security.IsAuthorizedTo(Rights.DeleteOwnPosts))
153+
throw new UnauthorizedAccessException();
154154
try
155155
{
156156
var core = (from c in Category.Categories.ToList() where c.Id == id select c).FirstOrDefault();

‎BlogEngine/BlogEngine.Core/Data/CommentFilterRepository.cs‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ public class CommentFilterRepository : ICommentFilterRepository
3131
/// <returns>List of comment filters</returns>
3232
public IEnumerable<CommentFilterItem> Find(int take = 10, int skip = 0, string filter = "", string order = "")
3333
{
34-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.AccessAdminPages))
35-
throw new System.UnauthorizedAccessException();
34+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
35+
throw new UnauthorizedAccessException();
3636

3737
var filterList = new List<CommentFilterItem>();
3838
try
@@ -89,8 +89,8 @@ public CommentFilterItem FindById(Guid id)
8989
/// <returns>New item</returns>
9090
public CommentFilterItem Add(CommentFilterItem item)
9191
{
92-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.AccessAdminPages))
93-
throw new System.UnauthorizedAccessException();
92+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
93+
throw new UnauthorizedAccessException();
9494

9595
try
9696
{
@@ -107,7 +107,7 @@ public CommentFilterItem Add(CommentFilterItem item)
107107
Filters.Parameters[4].Values[i] == item.Filter;
108108
if (exists)
109109
{
110-
throw new System.ApplicationException("Item already exists");
110+
throw new ApplicationException("Item already exists");
111111
}
112112
}
113113

@@ -153,6 +153,9 @@ public bool Update(CommentFilterItem item)
153153
/// <returns>True on success</returns>
154154
public bool RemoveAll()
155155
{
156+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
157+
throw new UnauthorizedAccessException();
158+
156159
try
157160
{
158161
for (int i = 0; i < Filters.Parameters.Count; i++)
@@ -181,6 +184,9 @@ public bool RemoveAll()
181184
/// <returns>True on success</returns>
182185
public bool Remove(Guid id)
183186
{
187+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
188+
throw new UnauthorizedAccessException();
189+
184190
int idx = 0;
185191
foreach (ExtensionParameter par in Filters.Parameters)
186192
{

‎BlogEngine/BlogEngine.Core/Data/CustomFilterRepository.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ public class CustomFilterRepository : ICustomFilterRepository
2323
/// <returns>List of filters</returns>
2424
public IEnumerable<CustomFilter> GetCustomFilters()
2525
{
26-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.AccessAdminPages))
27-
throw new System.UnauthorizedAccessException();
26+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
27+
throw new UnauthorizedAccessException();
2828

2929
var filterList = new List<CustomFilter>();
3030
try
@@ -63,8 +63,8 @@ public IEnumerable<CustomFilter> GetCustomFilters()
6363
/// <returns>Json response</returns>
6464
public JsonResponse ResetCounters(string filterName)
6565
{
66-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.AccessAdminPages))
67-
throw new System.UnauthorizedAccessException();
66+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
67+
throw new UnauthorizedAccessException();
6868
try
6969
{
7070
if (!string.IsNullOrEmpty(filterName))

‎BlogEngine/BlogEngine.Core/Data/DashboardRepository.cs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ public class DashboardRepository : IDashboardRepository
1414
/// <returns>Dashboard view model</returns>
1515
public DashboardVM Get()
1616
{
17+
if (!Security.IsAuthorizedTo(Rights.ViewDashboard))
18+
throw new System.UnauthorizedAccessException();
19+
1720
return new DashboardVM();
1821
}
1922
}

‎BlogEngine/BlogEngine.Core/Data/FileManagerRepository.cs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ public class FileManagerRepository : IFileManagerRepository
1616

1717
public IEnumerable<FileInstance> Find(int take = 10, int skip = 0, string path = "", string order = "")
1818
{
19+
if (!Security.IsAuthorizedTo(Rights.EditOwnPosts))
20+
throw new UnauthorizedAccessException();
21+
1922
var list = new List<FileInstance>();
2023
var rwr = Utils.RelativeWebRoot;
2124
var responsePath = "root";

‎BlogEngine/BlogEngine.Core/Data/LookupsRepository.cs‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ public class LookupsRepository : ILookupsRepository
2424
/// <returns>List of cultures</returns>
2525
public Lookups GetLookups()
2626
{
27-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.AccessAdminPages))
28-
throw new System.UnauthorizedAccessException();
27+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
28+
throw new UnauthorizedAccessException();
2929

3030
LoadCultures();
3131

@@ -178,6 +178,9 @@ void LoadEditorOptions()
178178
/// <param name="options">Options</param>
179179
public void SaveEditorOptions(EditorOptions options)
180180
{
181+
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
182+
throw new UnauthorizedAccessException();
183+
181184
var bs = BlogSettings.Instance;
182185
if (options.OptionType == "Post")
183186
{

‎BlogEngine/BlogEngine.Core/Data/SettingsRepository.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ public class SettingsRepository : ISettingsRepository
1515
/// <returns>Settings object</returns>
1616
public SettingsVM Get()
1717
{
18+
if (!Security.IsAuthorizedTo(Rights.AccessAdminSettingsPages))
19+
throw new System.UnauthorizedAccessException();
20+
1821
var vm = new SettingsVM();
1922

2023
vm.Settings = GetSettings();
@@ -29,7 +32,7 @@ public SettingsVM Get()
2932
/// <returns>True on success</returns>
3033
public bool Update(Settings ns)
3134
{
32-
if (!Security.IsAuthorizedTo(BlogEngine.Core.Rights.AccessAdminSettingsPages))
35+
if (!Security.IsAuthorizedTo(Rights.AccessAdminSettingsPages))
3336
throw new System.UnauthorizedAccessException();
3437

3538
var bs = BlogSettings.Instance;

‎BlogEngine/BlogEngine.Core/Data/TrashRepository.cs‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ public class TrashRepository : ITrashRepository
2323
/// <returns></returns>
2424
public TrashVM GetTrash(TrashType trashType, int take = 10, int skip = 0, string filter = "1 == 1", string order = "DateCreated descending")
2525
{
26-
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
26+
if (!Security.IsAuthorizedTo(Rights.ViewDashboard))
2727
throw new UnauthorizedAccessException();
2828

2929
var trash = new TrashVM();
@@ -135,8 +135,8 @@ public TrashVM GetTrash(TrashType trashType, int take = 10, int skip = 0, string
135135
/// <param name="id">Id</param>
136136
public bool Restore(string trashType, Guid id)
137137
{
138-
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
139-
throw new System.UnauthorizedAccessException();
138+
if (!Security.IsAuthorizedTo(Rights.ViewDashboard))
139+
throw new UnauthorizedAccessException();
140140

141141
switch (trashType)
142142
{
@@ -172,8 +172,8 @@ public bool Restore(string trashType, Guid id)
172172
/// <param name="id">Id</param>
173173
public bool Purge(string trashType, Guid id)
174174
{
175-
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
176-
throw new System.UnauthorizedAccessException();
175+
if (!Security.IsAuthorizedTo(Rights.ViewDashboard))
176+
throw new UnauthorizedAccessException();
177177

178178
switch (trashType)
179179
{
@@ -207,8 +207,8 @@ public bool Purge(string trashType, Guid id)
207207
/// </summary>
208208
public bool PurgeAll()
209209
{
210-
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
211-
throw new System.UnauthorizedAccessException();
210+
if (!Security.IsAuthorizedTo(Rights.ViewDashboard))
211+
throw new UnauthorizedAccessException();
212212

213213
// remove deleted comments
214214
foreach (var p in Post.Posts.ToArray())
@@ -248,7 +248,7 @@ public bool PurgeAll()
248248
/// <returns></returns>
249249
public JsonResponse PurgeLogfile()
250250
{
251-
if (!Security.IsAuthorizedTo(Rights.AccessAdminPages))
251+
if (!Security.IsAuthorizedTo(Rights.ViewDashboard))
252252
throw new UnauthorizedAccessException();
253253

254254
string fileLocation = System.Web.Hosting.HostingEnvironment.MapPath(System.IO.Path.Combine(BlogConfig.StorageLocation, "logger.txt"));

0 commit comments

Comments
 (0)