matt
/
opnform-host-nginx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update imporsonation routes (#477) 

Co-authored-by: Julien Nahum <julien@nahum.net>
This commit is contained in:
Chirag Chhatrala 2024-07-10 13:29:56 +05:30 committed by GitHub
parent 07a3a91645
commit b11f41d8b6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/Http/Middleware/ImpersonationMiddleware.php
View File

@ -36,6 +36,9 @@ class ImpersonationMiddleware
'open.forms.regenerate-link', 'open.forms.regenerate-link',
'open.forms.submissions', 'open.forms.submissions',
'open.forms.submissions.file', 'open.forms.submissions.file',
'open.providers',
'open.forms.integrations',
'open.forms.integrations.events',
// Workspaces // Workspaces
'open.workspaces.index', 'open.workspaces.index',
@ -66,7 +69,7 @@ class ImpersonationMiddleware
public function handle(Request $request, Closure $next) public function handle(Request $request, Closure $next)
{ {
try { try {
if (! auth()->check() || ! auth()->payload()->get('impersonating')) { if (!auth()->check() || !auth()->payload()->get('impersonating')) {
return $next($request); return $next($request);
} }
} catch (JWTException $e) { } catch (JWTException $e) {
@ -75,7 +78,7 @@ class ImpersonationMiddleware
// Check that route is allowed // Check that route is allowed
$routeName = $request->route()->getName(); $routeName = $request->route()->getName();
if (! in_array($routeName, self::ALLOWED_ROUTES)) { if (!in_array($routeName, self::ALLOWED_ROUTES)) {
return response([ return response([
'message' => 'Unauthorized when impersonating', 'message' => 'Unauthorized when impersonating',
'route' => $routeName, 'route' => $routeName,
@ -85,7 +88,7 @@ class ImpersonationMiddleware
'payload' => $request->all(), 'payload' => $request->all(),
], 403); ], 403);
} elseif (in_array($routeName, self::LOG_ROUTES)) { } elseif (in_array($routeName, self::LOG_ROUTES)) {
\Log::warning(self::ADMIN_LOG_PREFIX.'Impersonator action', [ \Log::warning(self::ADMIN_LOG_PREFIX . 'Impersonator action', [
'route' => $routeName, 'route' => $routeName,
'url' => $request->fullUrl(), 'url' => $request->fullUrl(),
'impersonated_account' => auth()->id(), 'impersonated_account' => auth()->id(),

2
routes/api.php
View File

@ -68,7 +68,7 @@ Route::group(['middleware' => 'auth:api'], function () {
}); });
Route::prefix('open')->name('open.')->group(function () { Route::prefix('open')->name('open.')->group(function () {
Route::get('/providers', [OAuthProviderController::class, 'index'])->name('index'); Route::get('/providers', [OAuthProviderController::class, 'index'])->name('providers');
Route::get('/forms', [FormController::class, 'indexAll'])->name('forms.index-all'); Route::get('/forms', [FormController::class, 'indexAll'])->name('forms.index-all');
Route::get('/forms/{slug}', [FormController::class, 'show'])->name('forms.show'); Route::get('/forms/{slug}', [FormController::class, 'show'])->name('forms.show');