- require flows.write permission for all http endpoints

naimo84 · Mar 12, 2024 · 92dec2c · 92dec2c
1 parent 34472f4
commit 92dec2c
Show file tree

Hide file tree

Showing 10 changed files with 10 additions and 10 deletions.
diff --git a/src/docker-config-actions.ts b/src/docker-config-actions.ts
@@ -147,7 +147,7 @@ module.exports = function (RED: Red) {
     }
 
 
-    RED.httpAdmin.post("/configSearch", function (req, res) {
+    RED.httpAdmin.post("/configSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /configSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-container-actions.ts b/src/docker-container-actions.ts
@@ -685,7 +685,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/containerSearch", function (req, res) {
+    RED.httpAdmin.post("/containerSearch", RED.auth.needsPermission('flows.write'), RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /containerSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-image-actions.ts b/src/docker-image-actions.ts
@@ -157,7 +157,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/imageSearch", function (req, res) {
+    RED.httpAdmin.post("/imageSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /imageSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-network-actions.ts b/src/docker-network-actions.ts
@@ -168,7 +168,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/networkSearch", function (req, res) {
+    RED.httpAdmin.post("/networkSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /networkSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-node-actions.ts b/src/docker-node-actions.ts
@@ -106,7 +106,7 @@ module.exports = function (RED: Red) {
     }
 
 
-    RED.httpAdmin.post("/nodeSearch", function (req, res) {
+    RED.httpAdmin.post("/nodeSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /nodeSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-plugin-actions.ts b/src/docker-plugin-actions.ts
@@ -226,7 +226,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/pluginSearch", function (req, res) {
+    RED.httpAdmin.post("/pluginSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /pluginSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-secret-actions.ts b/src/docker-secret-actions.ts
@@ -122,7 +122,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/secretSearch", function (req, res) {
+    RED.httpAdmin.post("/secretSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /secretSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-service-actions.ts b/src/docker-service-actions.ts
@@ -146,7 +146,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/serviceSearch", function (req, res) {
+    RED.httpAdmin.post("/serviceSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /serviceSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-task-actions.ts b/src/docker-task-actions.ts
@@ -91,7 +91,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/taskSearch", function (req, res) {
+    RED.httpAdmin.post("/taskSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /taskSearch");
 
         const nodeId = req.body.id;

diff --git a/src/docker-volume-actions.ts b/src/docker-volume-actions.ts
@@ -129,7 +129,7 @@ module.exports = function (RED: Red) {
         }
     }
 
-    RED.httpAdmin.post("/volumeSearch", function (req, res) {
+    RED.httpAdmin.post("/volumeSearch", RED.auth.needsPermission('flows.write'), function (req, res) {
         RED.log.debug("POST /volumeSearch");
 
         const nodeId = req.body.id;