Faulty permission handling in ajax grid actions (no message, infinite… · Marcoado/SmartStoreNET@619e8dc · GitHub
Skip to content

Commit 619e8dc

Browse files
mgesingmgesing
committed
Faulty permission handling in ajax grid actions (no message, infinite loading icon)(part 2)
1 parent ef6da8a commit 619e8dc

25 files changed

Lines changed: 2200 additions & 1902 deletions

‎src/Plugins/SmartStore.WebApi/Controllers/WebApiController.cs‎

Lines changed: 1 addition & 1 deletion

‎src/Presentation/SmartStore.Web/Administration/Controllers/LanguageController.cs‎

Lines changed: 103 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@ public LanguageController(ILanguageService languageService,
6060
}
6161

6262
#endregion
63-
#region Utilities
63+
64+
#region Utilities
6465

6566
[NonAction]
6667
private void PrepareFlagsModel(LanguageModel model)
@@ -123,18 +124,25 @@ public ActionResult List()
123124
[HttpPost, GridAction(EnableCustomBinding = true)]
124125
public ActionResult List(GridCommand command)
125126
{
126-
if (!_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
127-
return AccessDeniedView();
127+
var model = new GridModel<LanguageModel>();
128+
129+
if (_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
130+
{
131+
var languages = _languageService.GetAllLanguages(true);
132+
133+
model.Data = languages.Select(x => x.ToModel());
134+
model.Total = languages.Count();
135+
}
136+
else
137+
{
138+
model.Data = Enumerable.Empty<LanguageModel>();
139+
140+
NotifyAccessDenied();
141+
}
128142

129-
var languages = _languageService.GetAllLanguages(true);
130-
var gridModel = new GridModel<LanguageModel>
131-
{
132-
Data = languages.Select(x => x.ToModel()),
133-
Total = languages.Count()
134-
};
135143
return new JsonResult
136144
{
137-
Data = gridModel
145+
Data = model
138146
};
139147
}
140148

@@ -329,31 +337,37 @@ public ActionResult Resources(int languageId)
329337
[HttpPost, GridAction(EnableCustomBinding = true)]
330338
public ActionResult Resources(int languageId, GridCommand command)
331339
{
332-
if (!_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
333-
return AccessDeniedView();
340+
var model = new GridModel<LanguageResourceModel>();
334341

335-
var language = _languageService.GetLanguageById(languageId);
342+
if (_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
343+
{
344+
var language = _languageService.GetLanguageById(languageId);
345+
346+
var resources = _localizationService
347+
.GetResourceValues(languageId, true)
348+
.OrderBy(x => x.Key)
349+
.Where(x => x.Key != "!!___EOF___!!" && x.Value != null)
350+
.Select(x => new LanguageResourceModel
351+
{
352+
LanguageId = languageId,
353+
LanguageName = language.Name,
354+
Id = x.Value.Item1,
355+
Name = x.Key,
356+
Value = x.Value.Item2.EmptyNull(),
357+
})
358+
.ForCommand(command)
359+
.ToList();
360+
361+
model.Data = resources.PagedForCommand(command);
362+
model.Total = resources.Count;
363+
}
364+
else
365+
{
366+
model.Data = Enumerable.Empty<LanguageResourceModel>();
336367

337-
var resources = _localizationService
338-
.GetResourceValues(languageId, true)
339-
.OrderBy(x => x.Key)
340-
.Where(x => x.Key != "!!___EOF___!!" && x.Value != null)
341-
.Select(x => new LanguageResourceModel
342-
{
343-
LanguageId = languageId,
344-
LanguageName = language.Name,
345-
Id = x.Value.Item1,
346-
Name = x.Key,
347-
Value = x.Value.Item2.EmptyNull(),
348-
})
349-
.ForCommand(command)
350-
.ToList();
368+
NotifyAccessDenied();
369+
}
351370

352-
var model = new GridModel<LanguageResourceModel>
353-
{
354-
Data = resources.PagedForCommand(command),
355-
Total = resources.Count
356-
};
357371
return new JsonResult
358372
{
359373
Data = model
@@ -363,84 +377,84 @@ public ActionResult Resources(int languageId, GridCommand command)
363377
[GridAction(EnableCustomBinding = true)]
364378
public ActionResult ResourceUpdate(LanguageResourceModel model, GridCommand command)
365379
{
366-
if (!_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
367-
return AccessDeniedView();
380+
if (_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
381+
{
382+
if (model.Name != null)
383+
model.Name = model.Name.Trim();
384+
if (model.Value != null)
385+
model.Value = model.Value.Trim();
368386

369-
if (model.Name != null)
370-
model.Name = model.Name.Trim();
371-
if (model.Value != null)
372-
model.Value = model.Value.Trim();
387+
if (!ModelState.IsValid)
388+
{
389+
var modelStateErrors = this.ModelState.Values.SelectMany(x => x.Errors).Select(x => x.ErrorMessage);
390+
return Content(modelStateErrors.FirstOrDefault());
391+
}
373392

374-
if (!ModelState.IsValid)
375-
{
376-
//display the first model error
377-
var modelStateErrors = this.ModelState.Values.SelectMany(x => x.Errors).Select(x => x.ErrorMessage);
378-
return Content(modelStateErrors.FirstOrDefault());
379-
}
393+
var resource = _localizationService.GetLocaleStringResourceById(model.Id);
394+
// if the resourceName changed, ensure it isn't being used by another resource
395+
if (!resource.ResourceName.Equals(model.Name, StringComparison.InvariantCultureIgnoreCase))
396+
{
397+
var res = _localizationService.GetLocaleStringResourceByName(model.Name, model.LanguageId, false);
398+
if (res != null && res.Id != resource.Id)
399+
{
400+
return Content(T("Admin.Configuration.Languages.Resources.NameAlreadyExists", res.ResourceName));
401+
}
402+
}
380403

381-
var resource = _localizationService.GetLocaleStringResourceById(model.Id);
382-
// if the resourceName changed, ensure it isn't being used by another resource
383-
if (!resource.ResourceName.Equals(model.Name, StringComparison.InvariantCultureIgnoreCase))
384-
{
385-
var res = _localizationService.GetLocaleStringResourceByName(model.Name, model.LanguageId, false);
386-
if (res != null && res.Id != resource.Id)
387-
{
388-
return Content(string.Format(_localizationService.GetResource("Admin.Configuration.Languages.Resources.NameAlreadyExists"), res.ResourceName));
389-
}
390-
}
404+
resource.ResourceName = model.Name;
405+
resource.ResourceValue = model.Value;
406+
resource.IsTouched = true;
391407

392-
resource.ResourceName = model.Name;
393-
resource.ResourceValue = model.Value;
394-
resource.IsTouched = true;
395-
_localizationService.UpdateLocaleStringResource(resource);
408+
_localizationService.UpdateLocaleStringResource(resource);
409+
}
396410

397411
return Resources(model.LanguageId, command);
398412
}
399413

400414
[GridAction(EnableCustomBinding = true)]
401415
public ActionResult ResourceAdd(int id, LanguageResourceModel model, GridCommand command)
402416
{
403-
if (!_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
404-
return AccessDeniedView();
417+
if (_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
418+
{
419+
if (model.Name != null)
420+
model.Name = model.Name.Trim();
421+
if (model.Value != null)
422+
model.Value = model.Value.Trim();
405423

406-
if (model.Name != null)
407-
model.Name = model.Name.Trim();
408-
if (model.Value != null)
409-
model.Value = model.Value.Trim();
424+
if (!ModelState.IsValid)
425+
{
426+
var modelStateErrors = this.ModelState.Values.SelectMany(x => x.Errors).Select(x => x.ErrorMessage);
427+
return Content(modelStateErrors.FirstOrDefault());
428+
}
410429

411-
if (!ModelState.IsValid)
412-
{
413-
//display the first model error
414-
var modelStateErrors = this.ModelState.Values.SelectMany(x => x.Errors).Select(x => x.ErrorMessage);
415-
return Content(modelStateErrors.FirstOrDefault());
416-
}
430+
var res = _localizationService.GetLocaleStringResourceByName(model.Name, model.LanguageId, false);
431+
if (res == null)
432+
{
433+
var resource = new LocaleStringResource { LanguageId = id };
434+
resource.ResourceName = model.Name;
435+
resource.ResourceValue = model.Value;
436+
resource.IsTouched = true;
437+
438+
_localizationService.InsertLocaleStringResource(resource);
439+
}
440+
else
441+
{
442+
return Content(T("Admin.Configuration.Languages.Resources.NameAlreadyExists", model.Name));
443+
}
444+
}
417445

418-
var res = _localizationService.GetLocaleStringResourceByName(model.Name, model.LanguageId, false);
419-
if (res == null)
420-
{
421-
var resource = new LocaleStringResource { LanguageId = id };
422-
resource.ResourceName = model.Name;
423-
resource.ResourceValue = model.Value;
424-
resource.IsTouched = true;
425-
_localizationService.InsertLocaleStringResource(resource);
426-
}
427-
else
428-
{
429-
return Content(string.Format(_localizationService.GetResource("Admin.Configuration.Languages.Resources.NameAlreadyExists"), model.Name));
430-
}
431446
return Resources(id, command);
432447
}
433448

434449
[GridAction(EnableCustomBinding = true)]
435450
public ActionResult ResourceDelete(int id, int languageId, GridCommand command)
436451
{
437-
if (!_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
438-
return AccessDeniedView();
452+
if (_permissionService.Authorize(StandardPermissionProvider.ManageLanguages))
453+
{
454+
var resource = _localizationService.GetLocaleStringResourceById(id);
439455

440-
var resource = _localizationService.GetLocaleStringResourceById(id);
441-
if (resource == null)
442-
throw new ArgumentException("No resource found with the specified id");
443-
_localizationService.DeleteLocaleStringResource(resource);
456+
_localizationService.DeleteLocaleStringResource(resource);
457+
}
444458

445459
return Resources(languageId, command);
446460
}

‎src/Presentation/SmartStore.Web/Administration/Controllers/LogController.cs‎

Lines changed: 42 additions & 36 deletions

0 commit comments

Comments
 (0)