Paul Schneider
f7d090833d
Closes the data-leak holes that survived the move of these controllers from Yavsc.Api to Yavsc.Blogs. Circles are personal — a circle and its membership should never be visible, modifiable, or deletable by anyone other than its owner. BlogAclApiController: - GetBlogACL() was returning the full table; now filters by Allowed.OwnerId == caller's uid, with an Include(a => a.Allowed) so EF Core can push the filter into SQL instead of materialising the whole table. - Other endpoints (GetById, Put, Post, Delete) already enforced ownership; left as is. CircleApiController: - GetCircle() (no id) now filters by OwnerId. - GetCircle(id) now requires c.Id == id && c.OwnerId == uid; returns 404 (not 403) on miss to avoid leaking the existence of someone else's circle. - PutCircle verifies the existing record is owned by the caller, then forces circle.OwnerId = uid on the body (the client's value is ignored). Returns ChallengeResult when the caller doesn't own the record. - PostCircle forces circle.OwnerId = uid (was trusting the body). - DeleteCircle now filters by OwnerId; 404 on miss. All checks use the same source of truth (User.FindFirstValue( ClaimTypes.NameIdentifier)) that the existing BlogAclApiController authz code already relies on. |
||
|---|---|---|
| .. | ||
| Controllers | ||
| appsettings-blogs.json | ||
| Constants.cs | ||
| Program.cs | ||
| Yavsc.Blogs.csproj | ||