Security related admin updates

Author: rxtur

Blogifier.Core/Controllers/SettingsController.cs

@@ -28,22 +28,6 @@ public SettingsController(IUnitOfWork db, ILogger<SettingsController> logger)
             _theme = $"~/{ApplicationSettings.BlogAdminFolder}/Settings/";
         }
 
-        [VerifyProfile]
-        [Route("application")]
-        public IActionResult Application(int page = 1)
-        {
-            var pager = new Pager(page);
-            var blogs = _db.Profiles.ProfileList(p => p.Id > 0, pager);
-
-            var model = new AdminApplicationModel
-            {
-                Profile = GetProfile(),
-                Blogs = blogs,
-                Pager = pager
-            };
-            return View(_theme + "Application.cshtml", model);
-        }
-
         [Route("profile")]
         public IActionResult Profile()
         {
@@ -110,21 +94,14 @@ public IActionResult Profile(SettingsProfile model)
             return View(_theme + "Profile.cshtml", model);
         }
 
-        [VerifyProfile]
-        [Route("import")]
-        public IActionResult Import()
-        {
-            return View(_theme + "Import.cshtml", new AdminBaseModel { Profile = GetProfile() });
-        }
-
         [VerifyProfile]
         [Route("about")]
         public IActionResult About()
         {
             return View(_theme + "About.cshtml", new AdminBaseModel { Profile = GetProfile() });
         }
 
-        [VerifyProfile]
+        [MustBeAdmin]
         [Route("general")]
         public IActionResult General()
         {
@@ -149,6 +126,7 @@ public IActionResult General()
         }
 
         [HttpPost]
+        [MustBeAdmin]
         [Route("general")]
         public IActionResult General(SettingsGeneral model)
         {
@@ -184,7 +162,7 @@ public IActionResult General(SettingsGeneral model)
             return View(_theme + "General.cshtml", model);
         }
 
-        [VerifyProfile]
+        [MustBeAdmin]
         [Route("posts")]
         public IActionResult Posts()
         {
@@ -201,6 +179,7 @@ public IActionResult Posts()
         }
 
         [HttpPost]
+        [MustBeAdmin]
         [Route("posts")]
         public IActionResult Posts(SettingsPosts model)
         {
@@ -223,7 +202,7 @@ public IActionResult Posts(SettingsPosts model)
             return View(_theme + "Posts.cshtml", model);
         }
 
-        [VerifyProfile]
+        [MustBeAdmin]
         [Route("advanced")]
         public IActionResult Advanced()
         {

Blogifier.Core/Middleware/ActionFilters.cs

@@ -38,4 +38,32 @@ public override void OnActionExecuting(ActionExecutingContext filterContext)
             }
         }
     }
+
+    public class MustBeAdmin : ActionFilterAttribute
+    {
+        DbContextOptions<BlogifierDbContext> _options;
+
+        public MustBeAdmin()
+        {
+            var builder = new DbContextOptionsBuilder<BlogifierDbContext>();
+
+            ApplicationSettings.DatabaseOptions(builder);
+
+            _options = builder.Options;
+        }
+
+        public override void OnActionExecuting(ActionExecutingContext filterContext)
+        {
+            using (var context = new BlogifierDbContext(_options))
+            {
+                var loggedUser = filterContext.HttpContext.User.Identity.Name;
+                var profile = context.Profiles.SingleOrDefaultAsync(p => p.IdentityName == loggedUser).Result;
+
+                if(profile == null || !profile.IsAdmin)
+                {
+                    filterContext.Result = new RedirectResult("~/Error/403");
+                }
+            }
+        }
+    }
 }

Blogifier.Web/Controllers/SettingsController.cs

@@ -52,15 +52,11 @@ IUnitOfWork db
         [TempData]
         public string ErrorMessage { get; set; }
 
-        [VerifyProfile]
+        [MustBeAdmin]
         [Route("users")]
         public IActionResult Users(int page = 1)
         {
             var profile = GetProfile();
-            if (!profile.IsAdmin)
-            {
-                return View($"~/{ApplicationSettings.BlogThemesFolder}/{BlogSettings.Theme}/Error.cshtml", 403);
-            }
             var pager = new Pager(page);
             var blogs = _db.Profiles.ProfileList(p => p.Id > 0, pager);
 
@@ -72,6 +68,7 @@ public IActionResult Users(int page = 1)
         }
 
         [HttpPost]
+        [MustBeAdmin]
         [ValidateAntiForgeryToken]
         [Route("users")]
         public async Task<IActionResult> Register(UsersViewModel model, string returnUrl = null)
@@ -133,6 +130,7 @@ public async Task<IActionResult> Register(UsersViewModel model, string returnUrl
             return View(_theme + "Settings/Users.cshtml", regModel);
         }
 
+        [MustBeAdmin]
         [HttpDelete("{id}")]
         [Route("users/{id}")]
         public async Task<IActionResult> Delete(int id)

Blogifier.Web/Startup.cs

@@ -63,10 +63,6 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env)
                 app.UseDeveloperExceptionPage();
                 app.UseDatabaseErrorPage();
             }
-            else
-            {
-                app.UseExceptionHandler("/Home/Error");
-            }
 
             app.UseStaticFiles();
 

Blogifier.Web/Views/Blogifier/Admin/_Shared/_Taskbar.cshtml

@@ -33,12 +33,20 @@
                 <i class="taskbar-item-icon fa fa-cube"></i>
             </a>
         </li>
+        <li is-active-route asp-controller="Settings" class="taskbar-item">
+            <a asp-controller="Settings" asp-action="General" class="taskbar-item-link" title="Settings">
+                <i class="taskbar-item-icon fa fa-gear"></i>
+            </a>
+        </li>
+    }
+    else
+    {
+        <li is-active-route asp-controller="Settings" class="taskbar-item">
+            <a asp-controller="Settings" asp-action="Profile" class="taskbar-item-link" title="Settings">
+                <i class="taskbar-item-icon fa fa-gear"></i>
+            </a>
+        </li>
     }
-    <li is-active-route asp-controller="Settings" class="taskbar-item">
-        <a asp-controller="Settings" asp-action="General" class="taskbar-item-link" title="Settings">
-            <i class="taskbar-item-icon fa fa-gear"></i>
-        </a>
-    </li>
     <li class="taskbar-item ml-auto ml-lg-0 mt-lg-auto">
         <a class="taskbar-item-link" href="~/" return false;" title="Visit Blog" target="_blank"><i class="taskbar-item-icon fa fa-globe"></i></a>
     </li>

Blogifier.Web/wwwroot/admin/js/app/postsController.js

@@ -79,7 +79,7 @@ var postsController = function(dataService) {
 
   function reload() {
     setTimeout(function() {
-      window.location.href = webRoot + 'admin';
+      window.location.href = webRoot + 'admin/posts';
     }, 1000);
   }