mirror of
https://github.com/barkeser2002/offline-db.git
synced 2026-09-25 02:19:59 +03:00
Barış Keserandgoogle-labs-jules[bot]
6bed524d48
🚨 Severity: HIGH 💡 Vulnerability: The `RoomViewSet` in `apps/watchparty/views.py` only used the `IsAuthenticatedOrReadOnly` permission, meaning any authenticated user could modify or delete any active room. 🎯 Impact: An attacker could modify the name, status, or delete other users' watch party rooms without authorization. 🔧 Fix: Created a custom `IsHostOrReadOnly` permission class and added it to the `RoomViewSet`'s `permission_classes`. ✅ Verification: Ran `USE_SQLITE=True pytest apps/watchparty/` and added `test_room_host_authorization` which validates unauthenticated access (401), unauthorized authenticated access (403), and authorized access (200). Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
16 lines
551 B
Python
16 lines
551 B
Python
from rest_framework import permissions
|
|
|
|
class IsHostOrReadOnly(permissions.BasePermission):
|
|
"""
|
|
Custom permission to only allow the host of a room to edit or delete it.
|
|
"""
|
|
|
|
def has_object_permission(self, request, view, obj):
|
|
# Read permissions are allowed to any request,
|
|
# so we'll always allow GET, HEAD or OPTIONS requests.
|
|
if request.method in permissions.SAFE_METHODS:
|
|
return True
|
|
|
|
# Write permissions are only allowed to the host of the room.
|
|
return obj.host == request.user
|