From 12c2d252cf76c45bb8a2b457812540400465de3b Mon Sep 17 00:00:00 2001 From: Jannik Schönartz Date: Mon, 8 Jun 2020 00:31:55 +0000 Subject: [server] PM integration in all missing api-points but groups --- server/api/ipxeconfigs.js | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'server/api/ipxeconfigs.js') diff --git a/server/api/ipxeconfigs.js b/server/api/ipxeconfigs.js index 3c6f6eb..6845952 100644 --- a/server/api/ipxeconfigs.js +++ b/server/api/ipxeconfigs.js @@ -8,6 +8,24 @@ var router = decorateApp(express.Router()) const HttpResponse = require(path.join(__appdir, 'lib', 'httpresponse')) const log = require(path.join(__appdir, 'lib', 'log')) +// Permission check middleware +router.all(['', '/:x'], async (req, res, next) => { + switch (req.method) { + case 'GET': + if (!await req.user.hasPermission('ipxeconfigs.view')) return res.status(403).send({ error: 'Missing permission', permission: 'ipxeconfigs.view' }) + break + + case 'POST': case 'PUT': case 'DELETE': + if (!await req.user.hasPermission('ipxeconfigs.edit')) return res.status(403).send({ error: 'Missing permission', permission: 'ipxeconfigs.edit' }) + break + + default: + return res.status(400).send() + } + + next() +}) + // ############################################################################ // ########################### GET requests ################################# -- cgit v1.2.3-55-g7522