helpy4/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich synced 2025-11-14 17:36:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix asset upload permissions for shared links (#4325)

Browse source
This commit is contained in:
Daniel Dietzler 2023-10-03 18:36:51 +02:00 • committed by GitHub
parent e2f1e38472
commit e5f704cf3b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
server/src/domain/access/access.core.ts
View file

@ -10,6 +10,7 @@ export enum Permission {
ASSET_SHARE = 'asset.share',
ASSET_VIEW = 'asset.view',
ASSET_DOWNLOAD = 'asset.download',
ASSET_UPLOAD = 'asset.upload',
// ALBUM_CREATE = 'album.create',
ALBUM_READ = 'album.read',
@ -26,7 +27,6 @@ export enum Permission {
LIBRARY_CREATE = 'library.create',
LIBRARY_READ = 'library.read',
LIBRARY_WRITE = 'library.write',
LIBRARY_UPDATE = 'library.update',
LIBRARY_DELETE = 'library.delete',
LIBRARY_DOWNLOAD = 'library.download',
@ -96,6 +96,9 @@ export class AccessCore {
case Permission.ASSET_DOWNLOAD:
return !!authUser.isAllowDownload && (await this.repository.asset.hasSharedLinkAccess(sharedLinkId, id));
case Permission.ASSET_UPLOAD:
return authUser.isAllowUpload;
case Permission.ASSET_SHARE:
// TODO: fix this to not use authUser.id for shared link access control
return this.repository.asset.hasOwnerAccess(authUser.id, id);
@ -166,6 +169,9 @@ export class AccessCore {
(await this.repository.album.hasSharedAlbumAccess(authUser.id, id))
);
case Permission.ASSET_UPLOAD:
return this.repository.library.hasOwnerAccess(authUser.id, id);
case Permission.ALBUM_REMOVE_ASSET:
return this.repository.album.hasOwnerAccess(authUser.id, id);
@ -184,9 +190,6 @@ export class AccessCore {
(await this.repository.library.hasPartnerAccess(authUser.id, id))
);
case Permission.LIBRARY_WRITE:
return this.repository.library.hasOwnerAccess(authUser.id, id);
case Permission.LIBRARY_UPDATE:
return this.repository.library.hasOwnerAccess(authUser.id, id);