allow user to fuck with <user>.endpoints
continuous-integration/drone/push Build was killed Details

This commit is contained in:
Lizzy Hunt 2024-04-02 14:29:30 -06:00
parent eb1a6069d6
commit 3fa42bb2f6
Signed by untrusted user who does not match committer: simponic
GPG Key ID: 2909B9A7FF6213EE
1 changed files with 13 additions and 2 deletions

View File

@ -2,6 +2,7 @@ package api
import ( import (
"database/sql" "database/sql"
"fmt"
"log" "log"
"net/http" "net/http"
"strconv" "strconv"
@ -22,8 +23,18 @@ func userCanFuckWithDNSRecord(dbConn *sql.DB, user *database.User, record *datab
ownedByUser := (user.ID == record.UserID) ownedByUser := (user.ID == record.UserID)
if !record.Internal { if !record.Internal {
publicallyOwnedByUser := (record.Name == user.Username || strings.HasSuffix(record.Name, "."+user.Username)) userOwnedDomains := []string{
return ownedByUser && publicallyOwnedByUser fmt.Sprintf("%s", user.Username),
fmt.Sprintf("%s.endpoints", user.Username),
}
for _, domain := range userOwnedDomains {
isInSubDomain := strings.HasSuffix(record.Name, "."+domain)
ownedByUser = ownedByUser || domain == record.Name || isInSubDomain
}
return ownedByUser
} }
owner, err := database.FindFirstDomainOwnerId(dbConn, record.Name) owner, err := database.FindFirstDomainOwnerId(dbConn, record.Name)