fix: Allow adjacent import only for admins

Oberhauser-Dev · Nov 9, 2024 · dbab889 · dbab889
1 parent 707b93f
commit dbab889
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 5 deletions.
diff --git a/wrestling_scoreboard_client/lib/view/screens/overview/shared/actions.dart b/wrestling_scoreboard_client/lib/view/screens/overview/shared/actions.dart
@@ -179,12 +179,18 @@ class _IncludeSubjacentDialogState extends State<_IncludeSubjacentDialog> {
         mainAxisSize: MainAxisSize.min,
         children: [
           widget.child,
-          CheckboxListTile(
+          Restricted(
+            privilege: UserPrivilege.admin,
+            child: CheckboxListTile(
               title: Text(localizations.importIncludeSubjacent),
               value: _includeSubjacent,
-              onChanged: (v) => setState(() {
-                    _includeSubjacent = v ?? false;
-                  })),
+              onChanged: (v) => setState(
+                () {
+                  _includeSubjacent = v ?? false;
+                },
+              ),
+            ),
+          ),
         ],
       ),
     );

diff --git a/wrestling_scoreboard_server/lib/controllers/entity_controller.dart b/wrestling_scoreboard_server/lib/controllers/entity_controller.dart
@@ -77,7 +77,9 @@ mixin ImportController<T extends DataObject> implements ShelfController<T> {
     try {
       final message = await request.readAsString();
 
-      final includeSubjacent = bool.parse(queryParams['subjacent'] ?? 'false');
+      // Only admins can call a subjacent import, to prevent overwriting critical entities.
+      final includeSubjacent = bool.parse(queryParams['subjacent'] ?? 'false') &&
+          (user?.privilege ?? UserPrivilege.none) >= UserPrivilege.admin;
       final entity = await getSingle(entityId, obfuscate: obfuscate);
 
       final organization = getOrganization(entity);