Commitda23bf5

committed

only allow me on users

1 parentf1a33dc commitda23bf5Copy full SHA for da23bf5

File tree

-2

lines changed

-2

lines changed

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@ func parseUUID(rw http.ResponseWriter, r *http.Request, param string) (uuid.UUID`
`21`	`21`	`}`
`22`	`22`
`23`	`23`	`// Automatically set uuid.Nil to the acting users id.`
`24`		`-ifrawID=="me" {`
	`24`	`+ifparam==UserKey&&rawID=="me" {`
`25`	`25`	`key:=APIKey(r)`
`26`	`26`	`returnkey.UserID,true`
`27`	`27`	`}`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -9,6 +9,8 @@ import (`
`9`	`9`	`"github.com/coder/coder/coderd/httpapi"`
`10`	`10`	`)`
`11`	`11`
	`12`	`+constUserKey="user"`
	`13`	`+`
`12`	`14`	`typeuserParamContextKeystruct{}`
`13`	`15`
`14`	`16`	`// UserParam returns the user from the ExtractUserParam handler.`
`@@ -24,7 +26,7 @@ func UserParam(r *http.Request) database.User {`
`24`	`26`	`funcExtractUserParam(db database.Store)func(http.Handler) http.Handler {`
`25`	`27`	`returnfunc(next http.Handler) http.Handler {`
`26`	`28`	`returnhttp.HandlerFunc(func(rw http.ResponseWriter,r*http.Request) {`
`27`		`-userID,ok:=parseUUID(rw,r,"user")`
	`29`	`+userID,ok:=parseUUID(rw,r,UserKey)`
`28`	`30`	`if!ok {`
`29`	`31`	`return`
`30`	`32`	`}`

Comments

(0)