From 959a11a4a2d43bcbe024067cfda5f616b0932892 Mon Sep 17 00:00:00 2001 From: lukeIam Date: Tue, 29 Oct 2013 14:56:55 +0100 Subject: [PATCH] Webserver: use a methode for checking rights --- .../ClientServerLib/CWebservice.cs | 118 +++--------------- 1 file changed, 20 insertions(+), 98 deletions(-) diff --git a/ClientServerLib/ClientServerLib/CWebservice.cs b/ClientServerLib/ClientServerLib/CWebservice.cs index cd39312f..d5d63d70 100644 --- a/ClientServerLib/ClientServerLib/CWebservice.cs +++ b/ClientServerLib/ClientServerLib/CWebservice.cs @@ -29,25 +29,12 @@ namespace ServerLib public void SendKeyEvent(string key) { - Guid sessionKey = _GetSession(); + if (!_CheckRight(EUserRights.UseKeyboard)) + { + return; + } - if (sessionKey == Guid.Empty) - { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "No session"; - } - } - else if (!CSessionControl.RequestRight(sessionKey, EUserRights.UseKeyboard)) - { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "Not allowed"; - } - } - else if (CServer.SendKeyEvent == null) + if (CServer.SendKeyEvent == null) { if (WebOperationContext.Current != null) { @@ -94,24 +81,8 @@ namespace ServerLib if (profile.ProfileId != -1) //-1 is the id for a new profile { - if (sessionKey == Guid.Empty) + if (!(_CheckRight(EUserRights.EditAllProfiles) || CSessionControl.GetUserIdFromSession(sessionKey) == profile.ProfileId)) { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "No session"; - } - return; - } - - if (!CSessionControl.RequestRight(sessionKey, EUserRights.EditAllProfiles) && - CSessionControl.GetUserIdFromSession(sessionKey) != profile.ProfileId) - { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "Not allowed"; - } return; } } @@ -143,37 +114,22 @@ namespace ServerLib public SProfileData GetProfile(int profileId) { Guid sessionKey = _GetSession(); - - if (sessionKey == Guid.Empty) + if (_CheckRight(EUserRights.ViewOtherProfiles) || CSessionControl.GetUserIdFromSession(sessionKey) == profileId) { - if (WebOperationContext.Current != null) + if (CServer.GetProfileData == null) { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "No session"; + return new SProfileData(); } - return new SProfileData(); - } - if (!CSessionControl.RequestRight(sessionKey, EUserRights.ViewOtherProfiles) && - CSessionControl.GetUserIdFromSession(sessionKey) != profileId) - { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "Not allowed"; - } - return new SProfileData(); - } + bool isReadonly = (!CSessionControl.RequestRight(sessionKey, EUserRights.EditAllProfiles) && + CSessionControl.GetUserIdFromSession(sessionKey) != profileId); - if (CServer.GetProfileData == null) + return CServer.GetProfileData(profileId, isReadonly); + } + else { return new SProfileData(); } - - bool isReadonly = (!CSessionControl.RequestRight(sessionKey, EUserRights.EditAllProfiles) && - CSessionControl.GetUserIdFromSession(sessionKey) != profileId); - - return CServer.GetProfileData(profileId, isReadonly); } public SProfileData[] GetProfileList() @@ -191,28 +147,10 @@ namespace ServerLib public void SendPhoto(SPhotoData photo) { - Guid sessionKey = _GetSession(); - if (sessionKey == Guid.Empty) + if (_CheckRight(EUserRights.UploadPhotos)) { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "No session"; - } - return; + CServer.SendPhoto(photo); } - - if (!CSessionControl.RequestRight(sessionKey, EUserRights.UploadPhotos)) - { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "Not allowed"; - } - return; - } - - CServer.SendPhoto(photo); } #endregion @@ -363,7 +301,7 @@ namespace ServerLib public void AddSongToPlaylist(int songId, int playlistId, bool allowDuplicates) { - if (_CheckRight(EUserRights.AddSongToPlaylist)||_CheckRight(EUserRights.EditPlaylists)) + if (_CheckRight(EUserRights.AddSongToPlaylist) || _CheckRight(EUserRights.EditPlaylists)) { CServer.AddSongToPlaylist(songId, playlistId, allowDuplicates); } @@ -399,7 +337,7 @@ namespace ServerLib { return _CheckRight(EUserRights.EditPlaylists); } - + #endregion #region user management @@ -411,26 +349,10 @@ namespace ServerLib public void SetUserRole(int profileId, int userRole) { - Guid sessionKey = _GetSession(); - if (sessionKey == Guid.Empty) + if (_CheckRight(EUserRights.EditAllProfiles)) { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "No session"; - } - return; + CServer.SetUserRole(profileId, userRole); } - if (!CSessionControl.RequestRight(sessionKey, EUserRights.EditAllProfiles)) - { - if (WebOperationContext.Current != null) - { - WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Forbidden; - WebOperationContext.Current.OutgoingResponse.StatusDescription = "Not allowed"; - } - return; - } - CServer.SetUserRole(profileId, userRole); } private static bool _CheckRight(EUserRights requestedRight)