From 632fb636f2fcd23d7deff8fc60a620c61c9cff77 Mon Sep 17 00:00:00 2001 From: Andrew Kingston Date: Wed, 30 Jun 2021 21:54:48 +0100 Subject: [PATCH] Fix loophole where any user could load all screen and layout definitions via app package call --- packages/server/src/api/controllers/application.js | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/packages/server/src/api/controllers/application.js b/packages/server/src/api/controllers/application.js index 24cd1cd3c7..c165955b8b 100644 --- a/packages/server/src/api/controllers/application.js +++ b/packages/server/src/api/controllers/application.js @@ -164,7 +164,15 @@ exports.fetchAppDefinition = async function (ctx) { exports.fetchAppPackage = async function (ctx) { const db = new CouchDB(ctx.params.appId) const application = await db.get(DocumentTypes.APP_METADATA) - const [layouts, screens] = await Promise.all([getLayouts(db), getScreens(db)]) + const layouts = await getLayouts(db) + let screens = await getScreens(db) + + // Only filter screens if the user is not a builder + if (!ctx.user.builder?.global) { + const userRoleId = getUserRoleId(ctx) + const accessController = new AccessController(ctx.params.appId) + screens = await accessController.checkScreensAccess(screens, userRoleId) + } ctx.body = { application,