From 88cad2e15fd416cc77ca3987d1ffcc2d5207b9e1 Mon Sep 17 00:00:00 2001 From: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com> Date: Fri, 14 Oct 2022 11:52:20 +0200 Subject: [PATCH] Workflow security fixes (#4996) * security fix to not add even-types from other users * throw unauthroized error if a step does not belong to workflow Co-authored-by: CarinaWolli --- packages/trpc/server/routers/viewer/workflows.tsx | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/packages/trpc/server/routers/viewer/workflows.tsx b/packages/trpc/server/routers/viewer/workflows.tsx index b088ac4450..0acd8e9498 100644 --- a/packages/trpc/server/routers/viewer/workflows.tsx +++ b/packages/trpc/server/routers/viewer/workflows.tsx @@ -249,7 +249,12 @@ export const workflowsRouter = createProtectedRouter() }, }); - if (!userWorkflow || userWorkflow.userId !== user.id) throw new TRPCError({ code: "UNAUTHORIZED" }); + if ( + !userWorkflow || + userWorkflow.userId !== user.id || + steps.filter((step) => step.workflowId != id).length > 0 + ) + throw new TRPCError({ code: "UNAUTHORIZED" }); const oldActiveOnEventTypes = await ctx.prisma.workflowsOnEventTypes.findMany({ where: { @@ -290,7 +295,7 @@ export const workflowsRouter = createProtectedRouter() if ( newEventType && newEventType.userId !== user.id && - newEventType?.team?.members.filter((membership) => membership.userId === user.id).length === 0 + !newEventType?.team?.members.filter((membership) => membership.userId === user.id).length ) { throw new TRPCError({ code: "UNAUTHORIZED" }); } @@ -644,11 +649,7 @@ export const workflowsRouter = createProtectedRouter() const addedSteps = steps.map((s) => { if (s.id <= 0) { const { id: stepId, ...stepToAdd } = s; - if (stepToAdd.workflowId === id) { - return stepToAdd; - } else { - throw new TRPCError({ code: "UNAUTHORIZED" }); - } + return stepToAdd; } });