feat(events): add permissions check on event creation (#111)

PlaceOS · Sep 9, 2021 · d8bc41a · d8bc41a
1 parent 279e6c5
commit d8bc41a
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 45 deletions.
diff --git a/src/controllers/events.cr b/src/controllers/events.cr
@@ -93,7 +93,10 @@ class Events < Application
     input_event = PlaceCalendar::Event.from_json(request.body.as(IO))
     placeos_client = get_placeos_client
 
-    host = input_event.host || user.email
+    # get_user_calendars returns only calendars where the user has write access
+    user_email = user.email.downcase
+    host = input_event.host.try(&.downcase) || user_email
+    head :forbidden unless host == user_email || get_user_calendars.find { |cal| cal.id.try(&.downcase) == host }
 
     system_id = input_event.system_id || input_event.system.try(&.id)
     if system_id

diff --git a/src/controllers/utilities/google-helpers.cr b/src/controllers/utilities/google-helpers.cr