diff --git a/Controllers/VehicleController.cs b/Controllers/VehicleController.cs index fdada44..809c8f3 100644 --- a/Controllers/VehicleController.cs +++ b/Controllers/VehicleController.cs @@ -161,10 +161,6 @@ namespace CarCareTracker.Controllers [HttpGet] public IActionResult ExportFromVehicleToCsv(int vehicleId, ImportMode mode) { - if (vehicleId == default) - { - return Json(false); - } string uploadDirectory = "temp/"; string uploadPath = Path.Combine(_webEnv.WebRootPath, uploadDirectory); if (!Directory.Exists(uploadPath)) @@ -349,7 +345,7 @@ namespace CarCareTracker.Controllers [HttpPost] public IActionResult ImportToVehicleIdFromCsv(int vehicleId, ImportMode mode, string fileName) { - if (vehicleId == default || string.IsNullOrWhiteSpace(fileName)) + if (string.IsNullOrWhiteSpace(fileName)) { return Json(false); } @@ -1522,6 +1518,10 @@ namespace CarCareTracker.Controllers public IActionResult GetSupplyRecordsForRecordsByVehicleId(int vehicleId) { var result = _supplyRecordDataAccess.GetSupplyRecordsByVehicleId(vehicleId); + if (_config.GetServerEnableShopSupplies()) + { + result.AddRange(_supplyRecordDataAccess.GetSupplyRecordsByVehicleId(0)); // add shop supplies + } result.RemoveAll(x => x.Quantity <= 0); bool _useDescending = _config.GetUserConfig(User).UseDescending; if (_useDescending) diff --git a/Filter/CollaboratorFilter.cs b/Filter/CollaboratorFilter.cs index 550c458..c68f4f1 100644 --- a/Filter/CollaboratorFilter.cs +++ b/Filter/CollaboratorFilter.cs @@ -1,4 +1,5 @@ -using CarCareTracker.Logic; +using CarCareTracker.Helper; +using CarCareTracker.Logic; using CarCareTracker.Models; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; @@ -9,17 +10,31 @@ namespace CarCareTracker.Filter public class CollaboratorFilter: ActionFilterAttribute { private readonly IUserLogic _userLogic; - public CollaboratorFilter(IUserLogic userLogic) { + private readonly IConfigHelper _config; + public CollaboratorFilter(IUserLogic userLogic, IConfigHelper config) { _userLogic = userLogic; + _config = config; } public override void OnActionExecuting(ActionExecutingContext filterContext) { + var shopSupplyEndpoints = new List { "ImportToVehicleIdFromCsv", "GetSupplyRecordsByVehicleId", "ExportFromVehicleToCsv" }; if (!filterContext.HttpContext.User.IsInRole(nameof(UserData.IsRootUser))) { var vehicleId = int.Parse(filterContext.ActionArguments["vehicleId"].ToString()); - var userId = int.Parse(filterContext.HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier)); - if (!_userLogic.UserCanEditVehicle(userId, vehicleId)) + if (vehicleId != default) { + var userId = int.Parse(filterContext.HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier)); + if (!_userLogic.UserCanEditVehicle(userId, vehicleId)) + { + filterContext.Result = new RedirectResult("/Error/Unauthorized"); + } + } else if (shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString()) && !_config.GetServerEnableShopSupplies()) + { + //user trying to access shop supplies but shop supplies is not enabled by root user. + filterContext.Result = new RedirectResult("/Error/Unauthorized"); + } else if (!shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString())) + { + //user trying to access any other endpoints using 0 as vehicle id. filterContext.Result = new RedirectResult("/Error/Unauthorized"); } } diff --git a/Helper/ConfigHelper.cs b/Helper/ConfigHelper.cs index 41dffe2..e00345f 100644 --- a/Helper/ConfigHelper.cs +++ b/Helper/ConfigHelper.cs @@ -11,6 +11,7 @@ namespace CarCareTracker.Helper bool SaveUserConfig(ClaimsPrincipal user, UserConfig configData); string GetLogoUrl(); string GetServerLanguage(); + bool GetServerEnableShopSupplies(); public bool DeleteUserConfig(int userId); } public class ConfigHelper : IConfigHelper @@ -40,6 +41,10 @@ namespace CarCareTracker.Helper var serverLanguage = _config[nameof(UserConfig.UserLanguage)] ?? "en_US"; return serverLanguage; } + public bool GetServerEnableShopSupplies() + { + return bool.Parse(_config[nameof(UserConfig.EnableShopSupplies)] ?? "false"); + } public bool SaveUserConfig(ClaimsPrincipal user, UserConfig configData) { var storedUserId = user.FindFirstValue(ClaimTypes.NameIdentifier); diff --git a/Models/UserConfig.cs b/Models/UserConfig.cs index 7ff5f1d..5805f87 100644 --- a/Models/UserConfig.cs +++ b/Models/UserConfig.cs @@ -13,6 +13,7 @@ public bool UseMarkDownOnSavedNotes { get; set; } public bool EnableAutoReminderRefresh { get; set; } public bool EnableAutoOdometerInsert { get; set; } + public bool EnableShopSupplies { get; set; } public string PreferredGasUnit { get; set; } = string.Empty; public string PreferredGasMileageUnit { get; set; } = string.Empty; public string UserNameHash { get; set; } diff --git a/Views/Home/Index.cshtml b/Views/Home/Index.cshtml index b3391e5..eed9813 100644 --- a/Views/Home/Index.cshtml +++ b/Views/Home/Index.cshtml @@ -13,12 +13,20 @@ } @section Scripts { + + }
+
+
@@ -88,6 +104,12 @@ +