Add separate function to check if user has run the API command
This commit is contained in:
parent
893e37cd74
commit
f523925817
1 changed files with 11 additions and 1 deletions
|
@ -109,6 +109,16 @@ class UiWebsocket(object):
|
|||
self.log.error("WebSocket handleRequest error: %s" % Debug.formatException(err))
|
||||
self.cmd("error", "Internal error: %s" % Debug.formatException(err, "html"))
|
||||
|
||||
# Has permission to run the command
|
||||
def hasCmdPermission(self, cmd):
|
||||
cmd = cmd[0].lower() + cmd[1:]
|
||||
|
||||
if cmd in self.admin_commands and "ADMIN" not in self.permissions:
|
||||
return False
|
||||
else:
|
||||
return True
|
||||
|
||||
# Has permission to access a site
|
||||
def hasSitePermission(self, address):
|
||||
if address != self.site.address and "ADMIN" not in self.site.settings["permissions"]:
|
||||
return False
|
||||
|
@ -182,7 +192,7 @@ class UiWebsocket(object):
|
|||
|
||||
if cmd == "response": # It's a response to a command
|
||||
return self.actionResponse(req["to"], req["result"])
|
||||
elif cmd in self.admin_commands and "ADMIN" not in self.permissions: # Admin commands
|
||||
elif not self.hasCmdPermission(cmd): # Admin commands
|
||||
return self.response(req["id"], {"error": "You don't have permission to run %s" % cmd})
|
||||
else: # Normal command
|
||||
func_name = "action" + cmd[0].upper() + cmd[1:]
|
||||
|
|
Loading…
Reference in a new issue