From 0ca7ee38c04fe9ad0c7039157e0087d0492c9c0a Mon Sep 17 00:00:00 2001 From: naiba Date: Fri, 15 May 2026 02:46:06 +0000 Subject: [PATCH] fix(controller): filter listing endpoints by ownership Co-authored-by: naiba/CloudCode --- cmd/dashboard/controller/notification_group.go | 4 ++++ cmd/dashboard/controller/server_group.go | 9 ++++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/cmd/dashboard/controller/notification_group.go b/cmd/dashboard/controller/notification_group.go index 101cc324..677851e1 100644 --- a/cmd/dashboard/controller/notification_group.go +++ b/cmd/dashboard/controller/notification_group.go @@ -39,8 +39,12 @@ func listNotificationGroup(c *gin.Context) ([]*model.NotificationGroupResponseIt groupNotifications[n.NotificationGroupID] = append(groupNotifications[n.NotificationGroupID], n.NotificationID) } + isAdmin := callerIsAdmin(c) ngRes := make([]*model.NotificationGroupResponseItem, 0, len(ng)) for _, n := range ng { + if !isAdmin && !n.HasPermission(c) { + continue + } ngRes = append(ngRes, &model.NotificationGroupResponseItem{ Group: n, Notifications: groupNotifications[n.ID], diff --git a/cmd/dashboard/controller/server_group.go b/cmd/dashboard/controller/server_group.go index bc491e81..bcf11f15 100644 --- a/cmd/dashboard/controller/server_group.go +++ b/cmd/dashboard/controller/server_group.go @@ -27,10 +27,10 @@ func listServerGroup(c *gin.Context) ([]*model.ServerGroupResponseItem, error) { } _, isMember := c.Get(model.CtxKeyAuthorizedUser) - authorized := isMember + isAdmin := isMember && callerIsAdmin(c) visibleServerIDs := make(map[uint64]struct{}) - if !authorized { + if !isMember { for _, server := range singleton.ServerShared.GetSortedListForGuest() { visibleServerIDs[server.ID] = struct{}{} } @@ -42,7 +42,7 @@ func listServerGroup(c *gin.Context) ([]*model.ServerGroupResponseItem, error) { return nil, err } for _, s := range sgs { - if !authorized { + if !isMember { if _, ok := visibleServerIDs[s.ServerId]; !ok { continue } @@ -55,6 +55,9 @@ func listServerGroup(c *gin.Context) ([]*model.ServerGroupResponseItem, error) { var sgRes []*model.ServerGroupResponseItem for _, s := range sg { + if isMember && !isAdmin && !s.HasPermission(c) { + continue + } sgRes = append(sgRes, &model.ServerGroupResponseItem{ Group: s, Servers: groupServers[s.ID],