[api/frontend] Fix peromissions in user context

OpenCTI-Platform · Nov 29, 2021 · 8f827c3 · 8f827c3
1 parent 45d6578
commit 8f827c3
Show file tree

Hide file tree

Showing 2 changed files with 91 additions and 61 deletions.
diff --git a/opencti-platform/opencti-front/src/private/components/DashboardSettings.js b/opencti-platform/opencti-front/src/private/components/DashboardSettings.js
@@ -16,6 +16,7 @@ import Button from '@material-ui/core/Button';
 import Slide from '@material-ui/core/Slide';
 import graphql from 'babel-plugin-relay/macro';
 import { QueryRenderer } from '../../relay/environment';
+import Security, { EXPLORE } from '../../utils/Security';
 import inject18n from '../../components/i18n';
 
 const Transition = React.forwardRef((props, ref) => (
@@ -89,63 +90,92 @@ class DashboardSettings extends Component {
         >
           <DialogTitle>{t('Dashboard settings')}</DialogTitle>
           <DialogContent>
-            <QueryRenderer
-              query={dashboardSettingsDashboardsQuery}
-              variables={{
-                count: 50,
-                orderBy: 'name',
-                orderMode: 'asc',
-                filters: [{ key: 'type', values: ['dashboard'] }],
-              }}
-              render={({ props }) => {
-                if (props) {
-                  return (
-                    <div>
-                      <FormControl style={{ width: '100%' }}>
-                        <InputLabel id="timeField">
-                          {t('Date reference')}
-                        </InputLabel>
-                        <Select
-                          labelId="timeField"
-                          value={timeField === null ? '' : timeField}
-                          onChange={handleChangeTimeField.bind(this)}
-                          fullWidth={true}
-                        >
-                          <MenuItem value="technical">
-                            {t('Technical date')}
-                          </MenuItem>
-                          <MenuItem value="functional">
-                            {t('Functional date')}
-                          </MenuItem>
-                        </Select>
-                      </FormControl>
-                      <FormControl style={{ width: '100%', marginTop: 20 }}>
-                        <InputLabel id="timeField">
-                          {t('Custom dashboard')}
-                        </InputLabel>
-                        <Select
-                          labelId="dashboard"
-                          value={dashboard === null ? '' : dashboard}
-                          onChange={handleChangeDashboard.bind(this)}
-                          fullWidth={true}
-                        >
-                          <MenuItem value="default">{t('Default')}</MenuItem>
-                          {props.workspaces.edges.map((workspaceEdge) => {
-                            const workspace = workspaceEdge.node;
-                            return (
-                              <MenuItem key={workspace.id} value={workspace.id}>
-                                {workspace.name}
-                              </MenuItem>
-                            );
-                          })}
-                        </Select>
-                      </FormControl>
-                    </div>
-                  );
-                }
-                return <div />;
-              }}
-            />
+            <Security
+              needs={[EXPLORE]}
+              placeholder={
+                <div>
+                  <FormControl style={{ width: '100%' }}>
+                    <InputLabel id="timeField">
+                      {t('Date reference')}
+                    </InputLabel>
+                    <Select
+                      labelId="timeField"
+                      value={timeField === null ? '' : timeField}
+                      onChange={handleChangeTimeField.bind(this)}
+                      fullWidth={true}
+                    >
+                      <MenuItem value="technical">
+                        {t('Technical date')}
+                      </MenuItem>
+                      <MenuItem value="functional">
+                        {t('Functional date')}
+                      </MenuItem>
+                    </Select>
+                  </FormControl>
+                </div>
+              }
+            >
+              <QueryRenderer
+                query={dashboardSettingsDashboardsQuery}
+                variables={{
+                  count: 50,
+                  orderBy: 'name',
+                  orderMode: 'asc',
+                  filters: [{ key: 'type', values: ['dashboard'] }],
+                }}
+                render={({ props }) => {
+                  if (props) {
+                    return (
+                      <div>
+                        <FormControl style={{ width: '100%' }}>
+                          <InputLabel id="timeField">
+                            {t('Date reference')}
+                          </InputLabel>
+                          <Select
+                            labelId="timeField"
+                            value={timeField === null ? '' : timeField}
+                            onChange={handleChangeTimeField.bind(this)}
+                            fullWidth={true}
+                          >
+                            <MenuItem value="technical">
+                              {t('Technical date')}
+                            </MenuItem>
+                            <MenuItem value="functional">
+                              {t('Functional date')}
+                            </MenuItem>
+                          </Select>
+                        </FormControl>
+                        <FormControl style={{ width: '100%', marginTop: 20 }}>
+                          <InputLabel id="timeField">
+                            {t('Custom dashboard')}
+                          </InputLabel>
+                          <Select
+                            labelId="dashboard"
+                            value={dashboard === null ? '' : dashboard}
+                            onChange={handleChangeDashboard.bind(this)}
+                            fullWidth={true}
+                          >
+                            <MenuItem value="default">{t('Default')}</MenuItem>
+                            {props.workspaces.edges.map((workspaceEdge) => {
+                              const workspace = workspaceEdge.node;
+                              return (
+                                <MenuItem
+                                  key={workspace.id}
+                                  value={workspace.id}
+                                >
+                                  {workspace.name}
+                                </MenuItem>
+                              );
+                            })}
+                          </Select>
+                        </FormControl>
+                      </div>
+                    );
+                  }
+                  return <div />;
+                }}
+              />
+            </Security>
           </DialogContent>
           <DialogActions>
             <Button onClick={this.handleClose.bind(this)}>{t('Close')}</Button>

diff --git a/opencti-platform/opencti-graphql/config/schema/opencti.graphql b/opencti-platform/opencti-graphql/config/schema/opencti.graphql
@@ -144,15 +144,15 @@ type AppInfo {
   """
   The OpenCTI api current memory usage
   """
-  memory: AppMemory
+  memory: AppMemory @auth(for: [SETTINGS])
   """
   The list of OpenCTI software dependencies
   """
-  dependencies: [DependencyVersion!]!
+  dependencies: [DependencyVersion!]! @auth(for: [SETTINGS])
   """
   The objects statistics
   """
-  debugStats: AppDebugStatistics
+  debugStats: AppDebugStatistics @auth(for: [SETTINGS])
 }
 
 ### STATS
@@ -8491,7 +8491,7 @@ type Query {
   ###### INTERNAL
 
   platform_theme: String
-  about: AppInfo @auth(for: [SETTINGS])
+  about: AppInfo
   logsWorkerConfig: LogsWorkerConfig @auth(for: [MODULES])
   rabbitMQMetrics(prefix: String): RabbitMQMetrics @auth(for: [MODULES])
   elasticSearchMetrics: ElasticSearchMetrics @auth(for: [MODULES])