Skip to content
This repository has been archived by the owner on Jan 12, 2021. It is now read-only.

邮件大小写导致的权限问题 #40

Open
Gotric opened this issue Dec 20, 2018 · 0 comments
Open

邮件大小写导致的权限问题 #40

Gotric opened this issue Dec 20, 2018 · 0 comments

Comments

@Gotric
Copy link

Gotric commented Dec 20, 2018

insight/srcpm/app/src/views.py 漏洞列表、漏洞详细、漏洞操作的权限校验部分,由于email_dict['owner']做了小写处理,当注册用户邮件填写的是大写时,会触发弹403界面。

    if (current_user.email not in email_dict['owner']) and (current_user.email != 
   email_dict['department_manager']):
      					abort(403)

请改为将current_user.email做小写处理,

    if (current_user.email.lower() not in email_dict['owner']) and (current_user.email != 
   email_dict['department_manager']):
      					abort(403)
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant