diff --git a/WebCms/Controllers/DownloadController.cs b/WebCms/Controllers/DownloadController.cs index 3437692..b1842a6 100644 --- a/WebCms/Controllers/DownloadController.cs +++ b/WebCms/Controllers/DownloadController.cs @@ -5,6 +5,7 @@ using LeafWeb.Core.Entities; using LeafWeb.Core.Utility; using LeafWeb.WebCms.Models; using LeafWeb.WebCms.Utility; +using Microsoft.Ajax.Utilities; using Umbraco.Web.Mvc; namespace LeafWeb.WebCms.Controllers @@ -29,13 +30,31 @@ namespace LeafWeb.WebCms.Controllers [MemberAuthorize(AllowGroup = "Authenticated,Administrator")] public ActionResult Input(int id) { - return GetInputZip(id); + var leafInput = DataService.GetLeafInput(id); + + // check leafinput email matches current user + if (!Permissions.IsCurrentUserAdministrator() && + !leafInput.DoesBelongToUser(HttpContext.User.Identity.Name)) + { + return View("PermissionDenied"); + } + + return GetInputZip(leafInput); } [MemberAuthorize(AllowGroup = "Authenticated,Administrator")] public ActionResult OutputToUser(int id) { - return GetOutputZip(id, LeafOutputFileType.ToUser); + var leafInput = DataService.GetLeafInput(id); + + // check leafinput email matches current user + if (!Permissions.IsCurrentUserAdministrator() && + !leafInput.DoesBelongToUser(HttpContext.User.Identity.Name)) + { + return View("PermissionDenied"); + } + + return GetOutputZip(leafInput, LeafOutputFileType.ToUser); } [MemberAuthorize(AllowGroup = "Administrator")] @@ -44,42 +63,49 @@ namespace LeafWeb.WebCms.Controllers return GetOutputZip(id, LeafOutputFileType.NotToUser); } - [MemberAuthorize(AllowGroup = "Authenticated,Administrator")] + [MemberAuthorize(AllowGroup = "Administrator")] public ActionResult OutputCleanedInput(int id) { return GetOutputZip(id, LeafOutputFileType.CleanedInput); } - [MemberAuthorize(AllowGroup = "Authenticated,Administrator")] + [MemberAuthorize(AllowGroup = "Administrator")] public ActionResult ResultsInputZip(LeafDataQuery query) { return GetResults(query, LeafInput.GetInputFilesZip, $"LeafWeb_{DateTime.Now:yyyy-dd-MM--HH-mm-ss}_Input.zip"); } - [MemberAuthorize(AllowGroup = "Authenticated,Administrator")] + [MemberAuthorize(AllowGroup = "Administrator")] public ActionResult ResultsOutputZip(LeafDataQuery query) { return GetResults(query, LeafInput.GetOutputFilesZip_ToUser, $"LeafWeb_{DateTime.Now:yyyy-dd-MM--HH-mm-ss}_Output.zip"); } private ActionResult GetOutputZip(int id, LeafOutputFileType type) - { - var leafInput = DataService.GetLeafInput(id); + => GetOutputZip(DataService.GetLeafInput(id), type); + private ActionResult GetOutputZip(LeafInput leafInput, LeafOutputFileType type) + { if (leafInput == null) return View("DownloadNotFound"); var zip = leafInput.GetOutputFileZip(type); - var filename = $"{leafInput.Identifier.FilterValidFilename()}_{type}.zip"; + var suffix = + type == LeafOutputFileType.ToUser + ? "_Output" + : $"_Output_{type}"; + + var filename = $"{leafInput.Identifier.FilterValidFilename()}{suffix}.zip"; return new FileContentResult(zip, "application/zip") { FileDownloadName = filename }; } private ActionResult GetInputZip(int id) - { - var leafInput = DataService.GetLeafInput(id); + => GetInputZip(DataService.GetLeafInput(id)); + private ActionResult GetInputZip(LeafInput leafInput) + { if (leafInput == null) return View("DownloadNotFound"); diff --git a/WebCms/Controllers/ResultsController.cs b/WebCms/Controllers/ResultsController.cs index e2f1dbd..a5a2316 100644 --- a/WebCms/Controllers/ResultsController.cs +++ b/WebCms/Controllers/ResultsController.cs @@ -59,7 +59,6 @@ namespace LeafWeb.WebCms.Controllers return View(viewModel); } - public ActionResult Recent() { var dateThreshold = DateTime.Today.Subtract(TimeSpan.FromDays(90)); diff --git a/WebCms/Utility/Permissions.cs b/WebCms/Utility/Permissions.cs new file mode 100644 index 0000000..b887667 --- /dev/null +++ b/WebCms/Utility/Permissions.cs @@ -0,0 +1,20 @@ +using System; +using LeafWeb.Core.Entities; +using Umbraco.Web.Security; + +namespace LeafWeb.WebCms.Utility +{ + public static class Permissions + { + public static bool IsCurrentUserAdministrator() + { + var memberShipHelper = new MembershipHelper(Umbraco.Web.UmbracoContext.Current); + return memberShipHelper.IsMemberAuthorized(allowGroups: new[] {"Administrator"}); + } + + public static bool DoesBelongToUser(this LeafInput leafInput, string username) + { + return string.Equals(leafInput.Email, username, StringComparison.OrdinalIgnoreCase); + } + } +} \ No newline at end of file diff --git a/WebCms/Views/MacroPartials/Membership/Register.cshtml b/WebCms/Views/MacroPartials/Membership/Register.cshtml index 321b521..abbfe7e 100644 --- a/WebCms/Views/MacroPartials/Membership/Register.cshtml +++ b/WebCms/Views/MacroPartials/Membership/Register.cshtml @@ -40,7 +40,7 @@ else null, new {id="register-member"})) { - @Html.ValidationSummary(true) + @Html.ValidationSummary(false)