andrea/oef
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix regression: ambiguity between user_id and model_id

Browse source
This commit is contained in:
Andrea Fazzi 2020-02-03 17:12:15 +01:00
parent ea483a6e55
commit e40bedc91c
3 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
handlers/compose/docker-compose.yml
View file

@ -16,7 +16,7 @@ services:
smtp: smtp:
image: digiplant/fake-smtp image: digiplant/fake-smtp
container_name: oef_test_smtp container_name: oef_test_handlers_smtp
ports: ports:
- "1025:25" - "1025:25"

6
orm/participant.go
View file

@ -210,7 +210,7 @@ func (model *Participant) Create(db *Database, args map[string]string, w http.Re
// If user has "school" role get school id from token // If user has "school" role get school id from token
if isSchool(r) { if isSchool(r) {
schoolID, err := strconv.Atoi(getUserIDFromToken(r)) schoolID, err := strconv.Atoi(getModelIDFromToken(r))
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -267,7 +267,7 @@ func (model *Participant) Read(db *Database, args map[string]string, w http.Resp
return nil, err return nil, err
} }
if strconv.Itoa(int(participant.SchoolID)) != getUserIDFromToken(r) { if strconv.Itoa(int(participant.SchoolID)) != getModelIDFromToken(r) {
return nil, errors.NotAuthorized return nil, errors.NotAuthorized
} }
@ -304,7 +304,7 @@ func (model *Participant) ReadAll(db *Database, args map[string]string, w http.R
// School user can access to its participants only! // School user can access to its participants only!
if isSchool(r) { if isSchool(r) {
schoolId, err := strconv.Atoi(getUserIDFromToken(r)) schoolId, err := strconv.Atoi(getModelIDFromToken(r))
if err != nil { if err != nil {
return nil, err return nil, err
} }

2
orm/school.go
View file

@ -207,7 +207,7 @@ func (model *School) Read(db *Database, args map[string]string, w http.ResponseW
id := args["id"] id := args["id"]
if isSchool(r) && id != getUserIDFromToken(r) { if isSchool(r) && id != getModelIDFromToken(r) {
return nil, errors.NotAuthorized return nil, errors.NotAuthorized
} }