From 73e97e50f4e41221f54bedb791234e1797b6bb1f Mon Sep 17 00:00:00 2001
From: mike12345567 <me@michaeldrury.co.uk>
Date: Thu, 1 Apr 2021 14:38:31 +0100
Subject: [PATCH] Updating some route middleware security.

---
 .../server/src/api/controllers/search/index.js     | 11 ++++++-----
 packages/server/src/api/routes/auth.js             |  1 +
 packages/server/src/api/routes/search.js           | 13 ++++++++++++-
 packages/server/src/api/routes/static.js           | 14 ++++++++++++--
 packages/server/src/middleware/authorized.js       |  1 -
 5 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/packages/server/src/api/controllers/search/index.js b/packages/server/src/api/controllers/search/index.js
index 1810f07198..94b06db722 100644
--- a/packages/server/src/api/controllers/search/index.js
+++ b/packages/server/src/api/controllers/search/index.js
@@ -3,14 +3,15 @@ const { QueryBuilder, buildSearchUrl, search } = require("./utils")
 exports.rowSearch = async ctx => {
   // this can't be done through pouch, have to reach for trusty node-fetch
   const appId = ctx.user.appId
-  const bookmark = ctx.params.bookmark
+  const { tableId } = ctx.params
+  const { bookmark, query, raw } = ctx.request.body
   let url
-  if (ctx.params.query) {
-    url = new QueryBuilder(appId, ctx.params.query, bookmark).complete()
-  } else if (ctx.params.raw) {
+  if (query) {
+    url = new QueryBuilder(appId, query, bookmark).addTable(tableId).complete()
+  } else if (raw) {
     url = buildSearchUrl({
       appId,
-      query: ctx.params.raw,
+      query: raw,
       bookmark,
     })
   }
diff --git a/packages/server/src/api/routes/auth.js b/packages/server/src/api/routes/auth.js
index 83053305c9..ae640952ed 100644
--- a/packages/server/src/api/routes/auth.js
+++ b/packages/server/src/api/routes/auth.js
@@ -4,6 +4,7 @@ const controller = require("../controllers/auth")
 const router = Router()
 
 router.post("/api/authenticate", controller.authenticate)
+// doesn't need authorization as can only fetch info about self
 router.get("/api/self", controller.fetchSelf)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/search.js b/packages/server/src/api/routes/search.js
index 8858a72d6e..63493078b7 100644
--- a/packages/server/src/api/routes/search.js
+++ b/packages/server/src/api/routes/search.js
@@ -1,8 +1,19 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/search")
+const {
+  PermissionTypes,
+  PermissionLevels,
+} = require("../../utilities/security/permissions")
+const authorized = require("../../middleware/authorized")
+const { paramResource } = require("../../middleware/resourceId")
 
 const router = Router()
 
-router.get("/api/search/rows", controller.rowSearch)
+router.post(
+  "/api/search/:tableId/rows",
+  paramResource("tableId"),
+  authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+  controller.rowSearch
+)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/static.js b/packages/server/src/api/routes/static.js
index 14465f32a4..21c14f87a1 100644
--- a/packages/server/src/api/routes/static.js
+++ b/packages/server/src/api/routes/static.js
@@ -2,7 +2,11 @@ const Router = require("@koa/router")
 const controller = require("../controllers/static")
 const { budibaseTempDir } = require("../../utilities/budibaseDir")
 const authorized = require("../../middleware/authorized")
-const { BUILDER } = require("../../utilities/security/permissions")
+const {
+  BUILDER,
+  PermissionTypes,
+  PermissionLevels,
+} = require("../../utilities/security/permissions")
 const usage = require("../../middleware/usageQuota")
 const env = require("../../environment")
 
@@ -34,8 +38,14 @@ router
   // TODO: for now this builder endpoint is not authorized/secured, will need to be
   .get("/builder/:file*", controller.serveBuilder)
   .post("/api/attachments/process", authorized(BUILDER), controller.uploadFile)
-  .post("/api/attachments/upload", usage, controller.uploadFile)
+  .post(
+    "/api/attachments/upload",
+    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    usage,
+    controller.uploadFile
+  )
   .get("/componentlibrary", controller.serveComponentLibrary)
+  // TODO: this likely needs to be secured in some way
   .get("/:appId/:path*", controller.serveApp)
 
 module.exports = router
diff --git a/packages/server/src/middleware/authorized.js b/packages/server/src/middleware/authorized.js
index 04ae9291d1..c36e3c5b92 100644
--- a/packages/server/src/middleware/authorized.js
+++ b/packages/server/src/middleware/authorized.js
@@ -39,7 +39,6 @@ module.exports = (permType, permLevel = null) => async (ctx, next) => {
   }
 
   const role = ctx.user.role
-  const isBuilder = role._id === BUILTIN_ROLE_IDS.BUILDER
   const isAdmin = ADMIN_ROLES.includes(role._id)
   const isAuthed = ctx.auth.authenticated