forked from tangled.org/core
Monorepo for Tangled — https://tangled.org

knotserver/xrpc: fix incorrect permission check in repo.deleteBranch

the DID being used should be the repo-owner's DID and not the actor's
DID.

Signed-off-by: oppiliappan <me@oppi.li>

oppi.li 62a3b473 8d43875a

verified
Changed files
+2 -2
knotserver
+2 -2
knotserver/xrpc/delete_branch.go
···
}
repo := resp.Value.Val.(*tangled.Repo)
-
didPath, err := securejoin.SecureJoin(actorDid.String(), repo.Name)
+
didPath, err := securejoin.SecureJoin(ident.DID.String(), repo.Name)
if err != nil {
fail(xrpcerr.GenericError(err))
return
}
if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil {
-
l.Error("insufficent permissions", "did", actorDid.String())
+
l.Error("insufficent permissions", "did", actorDid.String(), "repo", didPath)
writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
return
}