starred/jellyfin-jellyfin-1
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2025-12-18 06:53:07 +03:00
Code Issues Packages Projects Releases Wiki Activity

set roles on connect endpoints

Browse Source
This commit is contained in:
Luke Pulverenti
2014-09-14 13:42:23 -04:00
parent 14bb0aa30c
commit 9991360d8a
5 changed files with 41 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
MediaBrowser.Server.Implementations/HttpServer/Security/AuthService.cs
View File

@@ -1,5 +1,4 @@
using System.Collections.Generic;
using MediaBrowser.Controller.Configuration;
using MediaBrowser.Controller.Configuration;
using MediaBrowser.Controller.Library;
using MediaBrowser.Controller.Net;
using MediaBrowser.Controller.Session;
@@ -42,24 +41,29 @@ namespace MediaBrowser.Server.Implementations.HttpServer.Security
/// </summary>
public string HtmlRedirect { get; set; }
public void Authenticate(IRequest req, IResponse res, object requestDto, bool allowLocal)
public void Authenticate(IRequest request,
IResponse response,
object requestDto,
bool allowLocal,
string[] roles)
{
if (HostContext.HasValidAuthSecret(req))
if (HostContext.HasValidAuthSecret(request))
return;
//ExecuteBasic(req, res, requestDto); //first check if session is authenticated
//if (res.IsClosed) return; //AuthenticateAttribute already closed the request (ie auth failed)
ValidateUser(req, allowLocal);
ValidateUser(request, allowLocal, roles);
}
private void ValidateUser(IRequest req, bool allowLocal)
private void ValidateUser(IRequest req, bool allowLocal,
string[] roles)
{
//This code is executed before the service
var auth = AuthorizationContext.GetAuthorizationInfo(req);
if (!string.IsNullOrWhiteSpace(auth.Token)
|| _config.Configuration.SecureApps1.Contains(auth.Client ?? string.Empty, StringComparer.OrdinalIgnoreCase))
|| _config.Configuration.SecureApps2.Contains(auth.Client ?? string.Empty, StringComparer.OrdinalIgnoreCase))
{
if (!allowLocal || !req.IsLocal)
{
@@ -73,8 +77,7 @@ namespace MediaBrowser.Server.Implementations.HttpServer.Security
if (user == null & !string.IsNullOrWhiteSpace(auth.UserId))
{
// TODO: Re-enable
//throw new ArgumentException("User with Id " + auth.UserId + " not found");
throw new ArgumentException("User with Id " + auth.UserId + " not found");
}
if (user != null && user.Configuration.IsDisabled)
@@ -82,6 +85,14 @@ namespace MediaBrowser.Server.Implementations.HttpServer.Security
throw new AuthenticationException("User account has been disabled.");
}
if (roles.Contains("admin", StringComparer.OrdinalIgnoreCase))
{
if (user == null || !user.Configuration.IsAdministrator)
{
throw new ArgumentException("Administrative access is required for this request.");
}
}
if (!string.IsNullOrWhiteSpace(auth.DeviceId) &&
!string.IsNullOrWhiteSpace(auth.Client) &&
!string.IsNullOrWhiteSpace(auth.Device))