Hardning security in authors and posts APIs

rxtur · rxtur · commit 882a86256e1d · 2019-05-11T14:56:55.000-05:00
diff --git a/src/Core/Api/AssetsController.cs b/src/Core/Api/AssetsController.cs
@@ -68,13 +68,14 @@ public async Task<AssetsModel> Get(int page = 1, string filter = "", string sear
         }
 
         /// <summary>
-        /// Select an asset in the File Manager to include in the post
+        /// Select an asset in the File Manager (authentication required)
         /// </summary>
         /// <param name="type">Type of asset (post cover, logo, avatar or post image/attachment)</param>
         /// <param name="asset">Selected asset</param>
         /// <param name="post">Post ID</param>
         /// <returns>Asset Item</returns>
         [HttpGet("pick")]
+        [Authorize]
         public async Task<AssetItem> Pick(string type, string asset, string post)
         {
             if (type == "postCover")
@@ -111,7 +112,7 @@ public async Task<AssetItem> Pick(string type, string asset, string post)
         }
 
         /// <summary>
-        /// Upload file(s) to user data store, authentication required
+        /// Upload file(s) to user data store (authentication required)
         /// </summary>
         /// <param name="files">Selected files</param>
         /// <returns>Success or internal error</returns>
@@ -134,7 +135,7 @@ public async Task<IActionResult> Upload(ICollection<IFormFile> files)
         }
 
         /// <summary>
-        /// Remove file from user data store, authentication required
+        /// Remove file from user data store (authentication required)
         /// </summary>
         /// <param name="url">Relative URL of the file to remove</param>
         /// <returns></returns>
diff --git a/src/Core/Api/AuthorsController.cs b/src/Core/Api/AuthorsController.cs
@@ -41,7 +41,7 @@ public async Task<ActionResult<IEnumerable<Author>>> Get(int page = 1)
             try
             {
                 var pager = new Pager(page);
-                var authors = await _data.Authors.GetList(u => u.Created > DateTime.MinValue, pager);
+                var authors = await _data.Authors.GetList(u => u.Created > DateTime.MinValue, pager, !User.Identity.IsAuthenticated);
                 return Ok(authors);
             }
             catch (Exception ex)
@@ -60,7 +60,7 @@ public async Task<ActionResult<Author>> Get(string author)
         {
             try
             {
-                var result = _data.Authors.Single(a => a.AppUserName == author);
+                var result = _data.Authors.GetItem(a => a.AppUserName == author, !User.Identity.IsAuthenticated);
                 if (result == null) return NotFound();
 
                 return Ok(await Task.FromResult(result));
@@ -72,7 +72,7 @@ public async Task<ActionResult<Author>> Get(string author)
         }
 
         /// <summary>
-        /// Register new author. Authorized admins only.
+        /// Register new author (admins only)
         /// </summary>
         /// <param name="model">Author model</param>
         /// <returns>Created Author object</returns>
@@ -114,7 +114,7 @@ public async Task<ActionResult<Author>> Post(RegisterModel model)
         }
 
         /// <summary>
-        /// Update author
+        /// Update author (admins only)
         /// </summary>
         /// <param name="model">Author model</param>
         /// <returns>Success or 500 error</returns>
@@ -138,7 +138,7 @@ public async Task<ActionResult> Update(Author model)
         }
 
         /// <summary>
-        /// Change author password. Authorized users only.
+        /// Change author password (authentication required)
         /// </summary>
         /// <param name="model">Author model</param>
         /// <returns>Success or 500 error</returns>
@@ -169,7 +169,7 @@ public async Task<ActionResult> ChangePwd(ChangePasswordModel model)
         }
 
         /// <summary>
-        /// Delete author, from membership, database and file system. Admin only.
+        /// Delete author, from membership, database and file system (admins only)
         /// </summary>
         /// <param name="id">Author ID</param>
         /// <returns>Success or 500 error</returns>
diff --git a/src/Core/Api/PostsController.cs b/src/Core/Api/PostsController.cs
@@ -95,18 +95,18 @@ public async Task<PostItem> GetPost(int id)
         {
             if (id > 0)
             {
-                return await _data.BlogPosts.GetItem(p => p.Id == id);
+                return await _data.BlogPosts.GetItem(p => p.Id == id, !User.Identity.IsAuthenticated);
             }
             else
             {
-                var author = await _data.Authors.GetItem(a => a.AppUserName == User.Identity.Name);
+                var author = await _data.Authors.GetItem(a => a.AppUserName == User.Identity.Name, !User.Identity.IsAuthenticated);
                 var blog = await _data.CustomFields.GetBlogSettings();
                 return new PostItem { Author = author, Cover = blog.Cover };
             }               
         }
 
         /// <summary>
-        /// Set post as published or draft
+        /// Set post as published or draft (authentication required)
         /// </summary>
         /// <param name="id">Post ID</param>
         /// <param name="flag">Flag; P - publish, U - unpublish</param>
@@ -137,7 +137,7 @@ public async Task<ActionResult> Publish(int id, string flag)
         }
 
         /// <summary>
-        /// Set post as featured
+        /// Set post as featured (admins only)
         /// </summary>
         /// <param name="id">Post ID</param>
         /// <param name="flag">Flag; F - featured, U - remove from featured</param>
@@ -168,7 +168,7 @@ public async Task<ActionResult> Feature(int id, string flag)
         }
 
         /// <summary>
-        /// Save blog post
+        /// Save blog post (authentication required)
         /// </summary>
         /// <param name="post">Post item</param>
         /// <returns>Saved post item</returns>
@@ -189,7 +189,7 @@ public async Task<ActionResult<PostItem>> Post(PostItem post)
         }
 
         /// <summary>
-        /// Remove post item
+        /// Remove post item (authentication required)
         /// </summary>
         /// <param name="id">Post ID</param>
         /// <returns>Success or failure</returns>
diff --git a/src/Core/Constants.cs b/src/Core/Constants.cs
@@ -17,6 +17,8 @@ public class Constants
         public static string BlogCover = "blog-cover";
         public static string Culture = "culture";
 
+        public static string DummyEmail = "dummy@blog.com";
+
         public static string ThemeEditReturnUrl = "~/admin/settings/theme";
     }
 }
diff --git a/src/Core/CoreAPI.xml b/src/Core/CoreAPI.xml
diff --git a/src/Core/Data/Repositories/AuthorRepository.cs b/src/Core/Data/Repositories/AuthorRepository.cs
@@ -9,8 +9,8 @@ namespace Core.Data
 {
     public interface IAuthorRepository : IRepository<Author>
     {
-        Task<Author> GetItem(Expression<Func<Author, bool>> predicate);
-        Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager);
+        Task<Author> GetItem(Expression<Func<Author, bool>> predicate, bool sanitized = false);
+        Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager, bool sanitize = false);
         Task Save(Author author);
         Task Remove(int id);
     }
@@ -24,7 +24,7 @@ public AuthorRepository(AppDbContext db) : base(db)
             _db = db;
         }
 
-        public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate)
+        public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate, bool sanitized = false)
         {
             try
             {
@@ -33,6 +33,7 @@ public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate)
                 if (author != null)
                 {
                     author.Avatar = author.Avatar ?? AppSettings.Avatar;
+                    author.Email = sanitized ? Constants.DummyEmail : author.Email;
                 }
 
                 return await Task.FromResult(author);
@@ -43,7 +44,7 @@ public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate)
             }
         }
 
-        public async Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager)
+        public async Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager, bool sanitize = false)
         {
             var take = pager.ItemsPerPage == 0 ? 10 : pager.ItemsPerPage;
             var skip = pager.CurrentPage * take - take;
@@ -55,6 +56,14 @@ public async Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> pr
 
             var list = users.Skip(skip).Take(take).ToList();
 
+            if (sanitize)
+            {
+                foreach (var item in list)
+                {
+                    item.Email = Constants.DummyEmail;
+                }
+            }
+
             return await Task.FromResult(list);
         }
 
diff --git a/src/Core/Data/Repositories/PostRepository.cs b/src/Core/Data/Repositories/PostRepository.cs
@@ -14,7 +14,7 @@ public interface IPostRepository : IRepository<BlogPost>
         Task<IEnumerable<PostItem>> GetList(Expression<Func<BlogPost, bool>> predicate, Pager pager);
         Task<IEnumerable<PostItem>> GetList(Pager pager, int author = 0, string category = "", string include = "", bool sanitize = false);
         Task<IEnumerable<PostItem>> Search(Pager pager, string term, int author = 0, string include = "", bool sanitize = false);
-        Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate);
+        Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate, bool sanitize = false);
         Task<PostModel> GetModel(string slug);
         Task<PostItem> SaveItem(PostItem item);
         Task SaveCover(int postId, string asset);
@@ -127,12 +127,13 @@ public async Task<IEnumerable<PostItem>> Search(Pager pager, string term, int au
             return await Task.Run(() => posts.Skip(skip).Take(pager.ItemsPerPage).ToList());
         }
 
-        public async Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate)
+        public async Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate, bool sanitize = false)
         {
             var post = _db.BlogPosts.Single(predicate);
             var item = PostToItem(post);
 
             item.Author.Avatar = string.IsNullOrEmpty(item.Author.Avatar) ? "lib/img/avatar.jpg" : item.Author.Avatar;
+            item.Author.Email = sanitize ? Constants.DummyEmail : item.Author.Email;
 
             return await Task.FromResult(item);
         }
@@ -273,7 +274,7 @@ PostItem PostToItem(BlogPost p, bool sanitize = false)
             {
                 post.Author.Avatar = string.IsNullOrEmpty(post.Author.Avatar) ?
                     AppSettings.Avatar : post.Author.Avatar;
-                post.Author.Email = sanitize ? "" : post.Author.Email;
+                post.Author.Email = sanitize ? Constants.DummyEmail : post.Author.Email;
             }
             return post;
         }
diff --git a/src/Core/Services/StorageService.cs b/src/Core/Services/StorageService.cs
@@ -271,7 +271,7 @@ public async Task<IEnumerable<AssetItem>> Find(Func<AssetItem, bool> predicate,
             {
                 foreach (var p in page)
                 {
-                    p.Path = "";
+                    p.Path = p.Path.Replace(Location, "");
                 }
             }
 

Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ public async Task<ActionResult<IEnumerable<Author>>> Get(int page = 1)`
`41`	`41`	`try`
`42`	`42`	`{`
`43`	`43`	`var pager = new Pager(page);`
`44`		`- var authors = await _data.Authors.GetList(u => u.Created > DateTime.MinValue, pager);`
	`44`	`+ var authors = await _data.Authors.GetList(u => u.Created > DateTime.MinValue, pager, !User.Identity.IsAuthenticated);`
`45`	`45`	`return Ok(authors);`
`46`	`46`	`}`
`47`	`47`	`catch (Exception ex)`
`@@ -60,7 +60,7 @@ public async Task<ActionResult<Author>> Get(string author)`
`60`	`60`	`{`
`61`	`61`	`try`
`62`	`62`	`{`
`63`		`- var result = _data.Authors.Single(a => a.AppUserName == author);`
	`63`	`+ var result = _data.Authors.GetItem(a => a.AppUserName == author, !User.Identity.IsAuthenticated);`
`64`	`64`	`if (result == null) return NotFound();`
`65`	`65`
`66`	`66`	`return Ok(await Task.FromResult(result));`
`@@ -72,7 +72,7 @@ public async Task<ActionResult<Author>> Get(string author)`
`72`	`72`	`}`
`73`	`73`
`74`	`74`	`/// <summary>`
`75`		`- /// Register new author. Authorized admins only.`
	`75`	`+ /// Register new author (admins only)`
`76`	`76`	`/// </summary>`
`77`	`77`	`/// <param name="model">Author model</param>`
`78`	`78`	`/// <returns>Created Author object</returns>`
`@@ -114,7 +114,7 @@ public async Task<ActionResult<Author>> Post(RegisterModel model)`
`114`	`114`	`}`
`115`	`115`
`116`	`116`	`/// <summary>`
`117`		`- /// Update author`
	`117`	`+ /// Update author (admins only)`
`118`	`118`	`/// </summary>`
`119`	`119`	`/// <param name="model">Author model</param>`
`120`	`120`	`/// <returns>Success or 500 error</returns>`
`@@ -138,7 +138,7 @@ public async Task<ActionResult> Update(Author model)`
`138`	`138`	`}`
`139`	`139`
`140`	`140`	`/// <summary>`
`141`		`- /// Change author password. Authorized users only.`
	`141`	`+ /// Change author password (authentication required)`
`142`	`142`	`/// </summary>`
`143`	`143`	`/// <param name="model">Author model</param>`
`144`	`144`	`/// <returns>Success or 500 error</returns>`
`@@ -169,7 +169,7 @@ public async Task<ActionResult> ChangePwd(ChangePasswordModel model)`
`169`	`169`	`}`
`170`	`170`
`171`	`171`	`/// <summary>`
`172`		`- /// Delete author, from membership, database and file system. Admin only.`
	`172`	`+ /// Delete author, from membership, database and file system (admins only)`
`173`	`173`	`/// </summary>`
`174`	`174`	`/// <param name="id">Author ID</param>`
`175`	`175`	`/// <returns>Success or 500 error</returns>`
Original file line number	Diff line number	Diff line change
`@@ -95,18 +95,18 @@ public async Task<PostItem> GetPost(int id)`
`95`	`95`	`{`
`96`	`96`	`if (id > 0)`
`97`	`97`	`{`
`98`		`- return await _data.BlogPosts.GetItem(p => p.Id == id);`
	`98`	`+ return await _data.BlogPosts.GetItem(p => p.Id == id, !User.Identity.IsAuthenticated);`
`99`	`99`	`}`
`100`	`100`	`else`
`101`	`101`	`{`
`102`		`- var author = await _data.Authors.GetItem(a => a.AppUserName == User.Identity.Name);`
	`102`	`+ var author = await _data.Authors.GetItem(a => a.AppUserName == User.Identity.Name, !User.Identity.IsAuthenticated);`
`103`	`103`	`var blog = await _data.CustomFields.GetBlogSettings();`
`104`	`104`	`return new PostItem { Author = author, Cover = blog.Cover };`
`105`	`105`	`}`
`106`	`106`	`}`
`107`	`107`
`108`	`108`	`/// <summary>`
`109`		`- /// Set post as published or draft`
	`109`	`+ /// Set post as published or draft (authentication required)`
`110`	`110`	`/// </summary>`
`111`	`111`	`/// <param name="id">Post ID</param>`
`112`	`112`	`/// <param name="flag">Flag; P - publish, U - unpublish</param>`
`@@ -137,7 +137,7 @@ public async Task<ActionResult> Publish(int id, string flag)`
`137`	`137`	`}`
`138`	`138`
`139`	`139`	`/// <summary>`
`140`		`- /// Set post as featured`
	`140`	`+ /// Set post as featured (admins only)`
`141`	`141`	`/// </summary>`
`142`	`142`	`/// <param name="id">Post ID</param>`
`143`	`143`	`/// <param name="flag">Flag; F - featured, U - remove from featured</param>`
`@@ -168,7 +168,7 @@ public async Task<ActionResult> Feature(int id, string flag)`
`168`	`168`	`}`
`169`	`169`
`170`	`170`	`/// <summary>`
`171`		`- /// Save blog post`
	`171`	`+ /// Save blog post (authentication required)`
`172`	`172`	`/// </summary>`
`173`	`173`	`/// <param name="post">Post item</param>`
`174`	`174`	`/// <returns>Saved post item</returns>`
`@@ -189,7 +189,7 @@ public async Task<ActionResult<PostItem>> Post(PostItem post)`
`189`	`189`	`}`
`190`	`190`
`191`	`191`	`/// <summary>`
`192`		`- /// Remove post item`
	`192`	`+ /// Remove post item (authentication required)`
`193`	`193`	`/// </summary>`
`194`	`194`	`/// <param name="id">Post ID</param>`
`195`	`195`	`/// <returns>Success or failure</returns>`
Original file line number	Diff line number	Diff line change
`@@ -17,6 +17,8 @@ public class Constants`
`17`	`17`	`public static string BlogCover = "blog-cover";`
`18`	`18`	`public static string Culture = "culture";`
`19`	`19`
	`20`	`+ public static string DummyEmail = "dummy@blog.com";`
	`21`	`+`
`20`	`22`	`public static string ThemeEditReturnUrl = "~/admin/settings/theme";`
`21`	`23`	`}`
`22`	`24`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9,8 +9,8 @@ namespace Core.Data`
`9`	`9`	`{`
`10`	`10`	`public interface IAuthorRepository : IRepository<Author>`
`11`	`11`	`{`
`12`		`- Task<Author> GetItem(Expression<Func<Author, bool>> predicate);`
`13`		`- Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager);`
	`12`	`+ Task<Author> GetItem(Expression<Func<Author, bool>> predicate, bool sanitized = false);`
	`13`	`+ Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager, bool sanitize = false);`
`14`	`14`	`Task Save(Author author);`
`15`	`15`	`Task Remove(int id);`
`16`	`16`	`}`
`@@ -24,7 +24,7 @@ public AuthorRepository(AppDbContext db) : base(db)`
`24`	`24`	`_db = db;`
`25`	`25`	`}`
`26`	`26`
`27`		`- public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate)`
	`27`	`+ public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate, bool sanitized = false)`
`28`	`28`	`{`
`29`	`29`	`try`
`30`	`30`	`{`
`@@ -33,6 +33,7 @@ public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate)`
`33`	`33`	`if (author != null)`
`34`	`34`	`{`
`35`	`35`	`author.Avatar = author.Avatar ?? AppSettings.Avatar;`
	`36`	`+ author.Email = sanitized ? Constants.DummyEmail : author.Email;`
`36`	`37`	`}`
`37`	`38`
`38`	`39`	`return await Task.FromResult(author);`
`@@ -43,7 +44,7 @@ public async Task<Author> GetItem(Expression<Func<Author, bool>> predicate)`
`43`	`44`	`}`
`44`	`45`	`}`
`45`	`46`
`46`		`- public async Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager)`
	`47`	`+ public async Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> predicate, Pager pager, bool sanitize = false)`
`47`	`48`	`{`
`48`	`49`	`var take = pager.ItemsPerPage == 0 ? 10 : pager.ItemsPerPage;`
`49`	`50`	`var skip = pager.CurrentPage * take - take;`
`@@ -55,6 +56,14 @@ public async Task<IEnumerable<Author>> GetList(Expression<Func<Author, bool>> pr`
`55`	`56`
`56`	`57`	`var list = users.Skip(skip).Take(take).ToList();`
`57`	`58`
	`59`	`+ if (sanitize)`
	`60`	`+ {`
	`61`	`+ foreach (var item in list)`
	`62`	`+ {`
	`63`	`+ item.Email = Constants.DummyEmail;`
	`64`	`+ }`
	`65`	`+ }`
	`66`	`+`
`58`	`67`	`return await Task.FromResult(list);`
`59`	`68`	`}`
`60`	`69`
Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ public interface IPostRepository : IRepository<BlogPost>`
`14`	`14`	`Task<IEnumerable<PostItem>> GetList(Expression<Func<BlogPost, bool>> predicate, Pager pager);`
`15`	`15`	`Task<IEnumerable<PostItem>> GetList(Pager pager, int author = 0, string category = "", string include = "", bool sanitize = false);`
`16`	`16`	`Task<IEnumerable<PostItem>> Search(Pager pager, string term, int author = 0, string include = "", bool sanitize = false);`
`17`		`- Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate);`
	`17`	`+ Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate, bool sanitize = false);`
`18`	`18`	`Task<PostModel> GetModel(string slug);`
`19`	`19`	`Task<PostItem> SaveItem(PostItem item);`
`20`	`20`	`Task SaveCover(int postId, string asset);`
`@@ -127,12 +127,13 @@ public async Task<IEnumerable<PostItem>> Search(Pager pager, string term, int au`
`127`	`127`	`return await Task.Run(() => posts.Skip(skip).Take(pager.ItemsPerPage).ToList());`
`128`	`128`	`}`
`129`	`129`
`130`		`- public async Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate)`
	`130`	`+ public async Task<PostItem> GetItem(Expression<Func<BlogPost, bool>> predicate, bool sanitize = false)`
`131`	`131`	`{`
`132`	`132`	`var post = _db.BlogPosts.Single(predicate);`
`133`	`133`	`var item = PostToItem(post);`
`134`	`134`
`135`	`135`	`item.Author.Avatar = string.IsNullOrEmpty(item.Author.Avatar) ? "lib/img/avatar.jpg" : item.Author.Avatar;`
	`136`	`+ item.Author.Email = sanitize ? Constants.DummyEmail : item.Author.Email;`
`136`	`137`
`137`	`138`	`return await Task.FromResult(item);`
`138`	`139`	`}`
`@@ -273,7 +274,7 @@ PostItem PostToItem(BlogPost p, bool sanitize = false)`
`273`	`274`	`{`
`274`	`275`	`post.Author.Avatar = string.IsNullOrEmpty(post.Author.Avatar) ?`
`275`	`276`	`AppSettings.Avatar : post.Author.Avatar;`
`276`		`- post.Author.Email = sanitize ? "" : post.Author.Email;`
	`277`	`+ post.Author.Email = sanitize ? Constants.DummyEmail : post.Author.Email;`
`277`	`278`	`}`
`278`	`279`	`return post;`
`279`	`280`	`}`
Original file line number	Diff line number	Diff line change
`@@ -271,7 +271,7 @@ public async Task<IEnumerable<AssetItem>> Find(Func<AssetItem, bool> predicate,`
`271`	`271`	`{`
`272`	`272`	`foreach (var p in page)`
`273`	`273`	`{`
`274`		`- p.Path = "";`
	`274`	`+ p.Path = p.Path.Replace(Location, "");`
`275`	`275`	`}`
`276`	`276`	`}`
`277`	`277`